Protect against (*tls.Conn).Read returning (0, nil)

The current implementation of (*tls.Conn).Read may return (0, nil) in
some circumstances, but bufio.Scanner interprets that as EOF. Until
that's fixed in go1.1, wrap the *tls.Conn in another object that
guarantees it never returns (0, nil).