move TLS preference check to startTLS and add PreferPlain