The most common password is “123456”—but not (entirely) because humans are dumb