Add STARTTLS support via TLSHandler hook