allow user-specified ciphers, with sane defaults