Move ClientTLSOptionsFactory init out of refresh_certificates