Another leak: tls_new_client_session