connection: always set `host` for TLS