webapps: offer secure ciphers by default