move TLS/SSL selection into start:
if both lwt.ssl and tls.lwt are available:
select based on CONDUIT_TLS environment variable (defaults to lwt.ssl)
if only one library is present, use it
if none, No_tls