auth: use $tls_in_cipher and not $tls_cipher