multiple calls to ssl_allowed should be merged