WARN for old-style client configuration

so we don't have surprises
TLS clients and non-TLS listeners are forbidden