A Bayesian perspective on how differential privacy could maintain voter anonymity