Drop non PFS ciphers and support for Windows XP + IE8

Recently a series of presentations came out that show that the
NSA et al are using the fact that RSA does not have PFS to attack
TLS connections where possible. They also show a preference for
passive attacks such as recording the TLS streams and decrypting
them with stolen RSA keys compared to atactive MITM attacks.

The only time we're using non-PFS ciphers is for Windows XP with
IE8. So we'll attempt to turn those off and see if anyone complains
that they can no longer access our services.