TFO: better detection of client fast-open connections (again)