lazily initalize TLS block on first access