properly clean up tunnels when they close
tunnel affinity by client identifier _and_ ip address