add callOnce

- uses double-checked locking (the correct one)

- all instances shared the same global mutex

- minimal overhead and simple API