Auditing Private Machine Learning: How Private is Private SGD?