improve tls checks; add xheaders options