Turn on TLSv1.3 downgrade protection by default