better uri scheme choices, add client tls support