adding webSecurity option and updating sslProtocol default