The BEAST Wins Again: Why TLS Keeps Failing to Protect HTTP