avoid HTTPClient 2.3.x which uses SSLv3 as default