negotiate version: supported are TLS_1_0 and TLS_1_1

use highest possible which the client and server want