diff --git a/app/build.gradle b/app/build.gradle
index af35acca..cb6fa9e2 100644
--- a/app/build.gradle
+++ b/app/build.gradle
@@ -15,7 +15,7 @@ android {
     defaultConfig {
         applicationId "at.bitfire.davdroid"
         minSdkVersion 14
-        targetSdkVersion 23
+        targetSdkVersion 22
 
         versionCode 79
         versionName "0.9.0.1"
@@ -39,6 +39,7 @@ android {
         disable 'InconsistentLayout'
         disable 'MergeRootFrame'
         disable 'MissingTranslation'
+        disable 'OldTargetApi'
         disable 'RtlEnabled'
         disable 'Typos'
     }
diff --git a/app/src/main/AndroidManifest.xml b/app/src/main/AndroidManifest.xml
index b36e0acd..6eeeb717 100644
--- a/app/src/main/AndroidManifest.xml
+++ b/app/src/main/AndroidManifest.xml
@@ -11,23 +11,26 @@
     package="at.bitfire.davdroid"
     android:installLocation="internalOnly">
 
+    <!-- normal permissions -->
     <uses-permission android:name="android.permission.INTERNET" />
-    <uses-permission android:name="android.permission.AUTHENTICATE_ACCOUNTS" />
     <uses-permission android:name="android.permission.GET_ACCOUNTS" />
-    <uses-permission android:name="android.permission.READ_CONTACTS" />
-    <uses-permission android:name="android.permission.WRITE_CONTACTS" />
-    <uses-permission android:name="android.permission.READ_CALENDAR" />
-    <uses-permission android:name="android.permission.WRITE_CALENDAR" />
     <uses-permission android:name="android.permission.READ_SYNC_SETTINGS" />
     <uses-permission android:name="android.permission.WRITE_SYNC_SETTINGS" />
 
+    <!-- legacy permissions -->
     <!-- for writing external log files; permission only required for SDK <= 18 because since then,
-    writing to app-private directory doesn't require extra permissions -->
+         writing to app-private directory doesn't require extra permissions -->
     <uses-permission android:name="android.permission.READ_EXTERNAL_STORAGE" android:maxSdkVersion="18" tools:ignore="UnusedAttribute"/>
     <uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE" android:maxSdkVersion="18" tools:ignore="UnusedAttribute"/>
 
-    <uses-permission android:name="org.dmfs.permission.READ_TASKS" />
-    <uses-permission android:name="org.dmfs.permission.WRITE_TASKS" />
+    <!-- other permissions -->
+    <uses-permission android:name="android.permission.AUTHENTICATE_ACCOUNTS" />
+    <uses-permission android:name="android.permission.READ_CONTACTS" />             <!-- android.permission-group.CONTACTS -->
+    <uses-permission android:name="android.permission.WRITE_CONTACTS" />
+    <uses-permission android:name="android.permission.READ_CALENDAR" />             <!-- android.permission-group.CALENDAR -->
+    <uses-permission android:name="android.permission.WRITE_CALENDAR" />
+
+    <!-- ical4android declares task access permissions -->
 
     <application
         android:allowBackup="true" android:fullBackupContent="false"  tools:ignore="UnusedAttribute"
diff --git a/app/src/main/java/at/bitfire/davdroid/SSLSocketFactoryCompat.java b/app/src/main/java/at/bitfire/davdroid/SSLSocketFactoryCompat.java
index 0a52b4cd..0f2bca32 100644
--- a/app/src/main/java/at/bitfire/davdroid/SSLSocketFactoryCompat.java
+++ b/app/src/main/java/at/bitfire/davdroid/SSLSocketFactoryCompat.java
@@ -20,6 +20,7 @@ import java.util.Arrays;
 import java.util.HashSet;
 import java.util.LinkedList;
 import java.util.List;
+import java.util.Locale;
 
 import javax.net.ssl.SSLContext;
 import javax.net.ssl.SSLSocket;
@@ -46,7 +47,7 @@ public class SSLSocketFactoryCompat extends SSLSocketFactory {
                 // - remove all SSL versions (especially SSLv3) because they're insecure now
                 List<String> protocols = new LinkedList<>();
                 for (String protocol : socket.getSupportedProtocols())
-                    if (!protocol.toUpperCase().contains("SSL"))
+                    if (!protocol.toUpperCase(Locale.US).contains("SSL"))
                         protocols.add(protocol);
                 Constants.log.debug("Setting allowed TLS protocols: " + TextUtils.join(", ", protocols));
                 SSLSocketFactoryCompat.protocols = protocols.toArray(new String[protocols.size()]);