Data dissemination and disclosure limitation in a world without microdata: A risk-utility framework for remote access analysis servers