prefer GCM ciphers; drop non-EC Diffie-Hellman ciphers