No, for some reason, I assumed it was thread-safe without making sure... That came back to megabyte me.
I switched to TLS instead of locking as it was the quickest patch to get it not crashing. I will revisit this at a later point.
It might be worth-while to have ConnectionPool be thread-safe. Either by default and/or through some locking-policy template parameter. Otherwise we'd have to lock on the user code, which might mean the lock will be held for much more than necessary, though I have not looked at the implementation yet.
At the very least it reduces the risk of end-users getting it wrong, like I did.