hsa: make http cli client thread safe