Use a separate webclient_context for tunnel establishment. I chose this way (instead of having tunnelling steps in the state machine of a single webclient_context) because I want to allow tunnelling of non-HTTP protocols sooner or later.