only STARTTLS if required or advertised