Shut down SSL sessions semi-gracefully.

Shut down SSL sessions semi-gracefully.

Before we shut down the socket, send a shutdown alert.  That should
prevent some cases where errors are reported when they shouldn't be (it
was happening if I did a --list-remote-interfaces in tcpdump).

While we're at it, do the SSL shutdown *before* closing the main active
socket; we were doing it *after*.  Also, fix a comment.