Toward Usable Access Control for End-users: A Case Study of Facebook Privacy Settings