Move connect ACL before TLS-on-connect