ikev2: do not accept rekey until old SA is deleted