Improvements to TLS support.

Allow the client to specify a list of CAs in connect().
Make 'end' event work for TLS streams.