tls: avoid app session preallocation