Add a TODO around handling of SSL_get_session() and SSL_get1_session()