anchor.diff:      | TLSClient
       | TLSServer
   
  -type TLStream(s:System.IO.Stream, options, b, ?own) =
  +type TLStream private (s:System.IO.Stream, options, b, ?own, ?sessionID) =
       inherit Stream()
   
       let own = defaultArg own true
  
positive.code:             else
                  (conn,read)
          | TLS.DontWrite conn -> wrapRead conn
  
      let mutable conn =
          let tcpStream = Tcp.create s
          let conn =
              match b with
              | TLSClient -> TLS.connect tcpStream options
              | TLSServer -> TLS.accept_connected tcpStream options
          doHS conn
  
      let rec wrapWrite conn msg =
          match TLS.write conn msg with
  
negative.code:                 | TLS.DontWrite conn -> wrapRead conn
              else
                  TLS.refuse conn q
                  closed <- true
                  raise (IOException(sprintf "TLS-HS: Asked to authorize a certificate"))
          | TLS.Handshaken conn -> closed <- false; wrapRead conn
          | TLS.Read (conn,msg) ->
              let read = undoMsg_i conn msg in
              if equalBytes read empty_bytes then
  