Use backports.ssl_match_hostname, instead of having our own logic