premature SSL closure should -- by default -- not be an exception