add initOnce

- uses double-checked locking (the correct one)

- all instances shared the same global mutex

- minimal overhead and simple API
Why are TLS variables disabled when the type system prevents you from doing it wrong anyway?