Move ssl3_pending into the record layer