On the difficulty of achieving Differential Privacy in practice: user-level guarantees in aggregate location data