Controlling access to network resources based on the identity of the device used, not the user's identity