users must not be able to set up TLS on subdomains