always use TLSv1; fixed parameter passing for GET requests