allow tls option to override both tls.connect and starttls options