use ldaps - no need to recommend insecure protocols