Add a new xp_tls flag to indicate handshake failure.

This new flag is used to disable the kernel code from closing the socket
upon handshake failure, so that the daemon can close it once SSL_accept()
has returned failure.