haproxy: ssl-in goes to tcp backend, not http

This allows arbitrary traffic to go through HAProxy (i.e. TaskMaster).

Previously the backend ended up in http mode, which was set as the global
default, so these would just end up as failed requests (502 or 504).