stricter validation for $starttls