better checking for SSL servers, even though it probably doesn't fix the cookie bug