Set an explicit cipher list that doesn't include EXPORT ciphers

@ab mind taking a look?

Is there a better cipher list we should use? Since we know what's on the other end, it seems like we should be able to bind it pretty tightly, although I worry about that affecting people running dummy servers for testing purposes.