connection: allow passing in a custom stream object to use instead of a new tcp socket

This should allow secure end-to-end connection hopping