Fix/improve the SSL configuration

- Do not extend config.express.serverOptions with config.ssl before
  the config validation is done: the former is undefined by default
  (#843) and that's OK as it would fire a validation warning otherwise.

- Use _.merge instead of the undefined _.recursive.defaults to set the
  default values of config.express.serverOptions (#844). Use _.extend
  if the serverOptions wasn't defined by the user's config.