Honor cipher suite configuration
Implement option for honor_cipher order, defaults to on on patched OTP
Add tunables for TLS versions allowed and whether to check CRLs

The default is to only allow TLS 1.2 and to check the CRL of any client
certificates.

This addresses some of the concerns in basho/riak#433
Address review comments