tls: set flag whenever app session is freed