only allow TLS for SSL connections

This fixes the POODLE SSLv3 vulnerability
cc @dangoor this is already fixed in the deployed app, but this is the PR for the fix.