tls: preallocate app sessions on connect/accept