diff --git a/include/libwebsockets/lws-protocols-plugins.h b/include/libwebsockets/lws-protocols-plugins.h
index addf79f1a..869c76f44 100644
--- a/include/libwebsockets/lws-protocols-plugins.h
+++ b/include/libwebsockets/lws-protocols-plugins.h
@@ -68,7 +68,7 @@ struct lws_protocols {
 	 * to the selected protocol.  For example if this protocol was
 	 * called "myprotocol-v2", you might set id to 2, and the user
 	 * code that acts differently according to the version can do so by
-	 * switch (wsi->protocol->id), user code might use some bits as
+	 * switch (wsi->a.protocol->id), user code might use some bits as
 	 * capability flags based on selected protocol version, etc. */
 	void *user; /**< ignored by lws, but user code can pass a pointer
 			here it can later access from the protocol callback */
diff --git a/lib/core-net/adopt.c b/lib/core-net/adopt.c
index 5d95f63cf..5fd3aff62 100644
--- a/lib/core-net/adopt.c
+++ b/lib/core-net/adopt.c
@@ -70,7 +70,7 @@ lws_create_new_server_wsi(struct lws_vhost *vhost, int fixed_tsi)
 		   vhost->name, new_wsi->tsi);
 
 	lws_vhost_bind_wsi(vhost, new_wsi);
-	new_wsi->context = vhost->context;
+	new_wsi->a.context = vhost->context;
 	new_wsi->pending_timeout = NO_PENDING_TIMEOUT;
 	new_wsi->rxflow_change_to = LWS_RXFLOW_ALLOW;
 	new_wsi->retry_policy = vhost->retry_policy;
@@ -95,7 +95,7 @@ lws_create_new_server_wsi(struct lws_vhost *vhost, int fixed_tsi)
 	 * to the start of the supported list, so it can look
 	 * for matching ones during the handshake
 	 */
-	new_wsi->protocol = vhost->protocols;
+	new_wsi->a.protocol = vhost->protocols;
 	new_wsi->user_space = NULL;
 	new_wsi->desc.sockfd = LWS_SOCK_INVALID;
 	new_wsi->position_in_fds_table = LWS_NO_FDS_POS;
@@ -138,7 +138,7 @@ lws_adopt_descriptor_vhost1(struct lws_vhost *vh, lws_adoption_type type,
 	if (!new_wsi)
 		return NULL;
 
-	new_wsi->opaque_user_data = opaque;
+	new_wsi->a.opaque_user_data = opaque;
 
 	pt = &context->pt[(int)new_wsi->tsi];
 	lws_stats_bump(pt, LWSSTATS_C_CONNECTIONS, 1);
@@ -150,11 +150,11 @@ lws_adopt_descriptor_vhost1(struct lws_vhost *vh, lws_adoption_type type,
 	}
 
 	if (vh_prot_name) {
-		new_wsi->protocol = lws_vhost_name_to_protocol(new_wsi->vhost,
+		new_wsi->a.protocol = lws_vhost_name_to_protocol(new_wsi->a.vhost,
 							       vh_prot_name);
-		if (!new_wsi->protocol) {
+		if (!new_wsi->a.protocol) {
 			lwsl_err("Protocol %s not enabled on vhost %s\n",
-				 vh_prot_name, new_wsi->vhost->name);
+				 vh_prot_name, new_wsi->a.vhost->name);
 			goto bail;
 		}
 		if (lws_ensure_user_space(new_wsi)) {
@@ -174,7 +174,7 @@ lws_adopt_descriptor_vhost1(struct lws_vhost *vh, lws_adoption_type type,
 	 * he gets another identity (he may do async dns now...)
 	 */
 	lws_dll2_add_head(&new_wsi->vh_awaiting_socket,
-			  &new_wsi->vhost->vh_awaiting_socket_owner);
+			  &new_wsi->a.vhost->vh_awaiting_socket_owner);
 
 	return new_wsi;
 
@@ -198,7 +198,7 @@ lws_adopt_descriptor_vhost2(struct lws *new_wsi, lws_adoption_type type,
 			    lws_sock_file_fd_type fd)
 {
 	struct lws_context_per_thread *pt =
-			&new_wsi->context->pt[(int)new_wsi->tsi];
+			&new_wsi->a.context->pt[(int)new_wsi->tsi];
 	int n;
 
 	/* enforce that every fd is nonblocking */
@@ -221,7 +221,7 @@ lws_adopt_descriptor_vhost2(struct lws *new_wsi, lws_adoption_type type,
 
 	new_wsi->desc = fd;
 
-	if (!LWS_SSL_ENABLED(new_wsi->vhost) ||
+	if (!LWS_SSL_ENABLED(new_wsi->a.vhost) ||
 	    !(type & LWS_ADOPT_SOCKET))
 		type &= ~LWS_ADOPT_ALLOW_SSL;
 
@@ -236,8 +236,8 @@ lws_adopt_descriptor_vhost2(struct lws *new_wsi, lws_adoption_type type,
 	if (new_wsi->role_ops->adoption_cb[lwsi_role_server(new_wsi)])
 		n = new_wsi->role_ops->adoption_cb[lwsi_role_server(new_wsi)];
 
-	if (new_wsi->context->event_loop_ops->sock_accept)
-		if (new_wsi->context->event_loop_ops->sock_accept(new_wsi))
+	if (new_wsi->a.context->event_loop_ops->sock_accept)
+		if (new_wsi->a.context->event_loop_ops->sock_accept(new_wsi))
 			goto fail;
 
 #if LWS_MAX_SMP > 1
@@ -251,7 +251,7 @@ lws_adopt_descriptor_vhost2(struct lws *new_wsi, lws_adoption_type type,
 
 	if (!(type & LWS_ADOPT_ALLOW_SSL)) {
 		lws_pt_lock(pt, __func__);
-		if (__insert_wsi_socket_into_fds(new_wsi->context, new_wsi)) {
+		if (__insert_wsi_socket_into_fds(new_wsi->a.context, new_wsi)) {
 			lws_pt_unlock(pt);
 			lwsl_err("%s: fail inserting socket\n", __func__);
 			goto fail;
@@ -278,14 +278,14 @@ lws_adopt_descriptor_vhost2(struct lws *new_wsi, lws_adoption_type type,
 	 *  by deferring callback to this point, after insertion to fds,
 	 * lws_callback_on_writable() can work from the callback
 	 */
-	if ((new_wsi->protocol->callback)(new_wsi, n, new_wsi->user_space,
+	if ((new_wsi->a.protocol->callback)(new_wsi, n, new_wsi->user_space,
 					  NULL, 0))
 		goto fail;
 
 	/* role may need to do something after all adoption completed */
 
 	lws_role_call_adoption_bind(new_wsi, type | _LWS_ADOPT_FINISH,
-				    new_wsi->protocol->name);
+				    new_wsi->a.protocol->name);
 
 #if LWS_MAX_SMP > 1
 	/* its actual pt can service it now */
@@ -409,7 +409,7 @@ adopt_socket_readbuf(struct lws *wsi, const char *readbuf, size_t len)
 	if (wsi->position_in_fds_table == LWS_NO_FDS_POS)
 		return wsi;
 
-	pt = &wsi->context->pt[(int)wsi->tsi];
+	pt = &wsi->a.context->pt[(int)wsi->tsi];
 
 	n = lws_buflist_append_segment(&wsi->buflist, (const uint8_t *)readbuf,
 				       len);
@@ -441,7 +441,7 @@ adopt_socket_readbuf(struct lws *wsi, const char *readbuf, size_t len)
 		pfd = &pt->fds[wsi->position_in_fds_table];
 		pfd->revents |= LWS_POLLIN;
 		lwsl_err("%s: calling service\n", __func__);
-		if (lws_service_fd_tsi(wsi->context, pfd, wsi->tsi))
+		if (lws_service_fd_tsi(wsi->a.context, pfd, wsi->tsi))
 			/* service closed us */
 			return NULL;
 
diff --git a/lib/core-net/close.c b/lib/core-net/close.c
index 0b02a3cdd..5a97657a1 100644
--- a/lib/core-net/close.c
+++ b/lib/core-net/close.c
@@ -50,7 +50,7 @@ __lws_reset_wsi(struct lws *wsi)
 	 * if we have wsi in our transaction queue, if we are closing we
 	 * must go through and close all those first
 	 */
-	if (wsi->vhost) {
+	if (wsi->a.vhost) {
 
 		/* we are no longer an active client connection that can piggyback */
 		lws_dll2_remove(&wsi->dll_cli_active_conns);
@@ -71,18 +71,18 @@ __lws_reset_wsi(struct lws *wsi)
 	}
 #endif
 
-	if (wsi->vhost)
+	if (wsi->a.vhost)
 		lws_dll2_remove(&wsi->vh_awaiting_socket);
 
 	/*
 	 * Protocol user data may be allocated either internally by lws
 	 * or by specified the user. We should only free what we allocated.
 	 */
-	if (wsi->protocol && wsi->protocol->per_session_data_size &&
+	if (wsi->a.protocol && wsi->a.protocol->per_session_data_size &&
 	    wsi->user_space && !wsi->user_space_externally_allocated) {
 		/* confirm no sul left scheduled in user data itself */
-		lws_sul_debug_zombies(wsi->context, wsi->user_space,
-				wsi->protocol->per_session_data_size, __func__);
+		lws_sul_debug_zombies(wsi->a.context, wsi->user_space,
+				wsi->a.protocol->per_session_data_size, __func__);
 		lws_free_set_NULL(wsi->user_space);
 	}
 
@@ -97,7 +97,7 @@ __lws_reset_wsi(struct lws *wsi)
 #if defined(LWS_WITH_UDP)
 	if (wsi->udp) {
 		/* confirm no sul left scheduled in wsi->udp itself */
-		lws_sul_debug_zombies(wsi->context, wsi->udp,
+		lws_sul_debug_zombies(wsi->a.context, wsi->udp,
 				      sizeof(*wsi->udp), "close udp wsi");
 		lws_free_set_NULL(wsi->udp);
 	}
@@ -118,13 +118,13 @@ __lws_reset_wsi(struct lws *wsi)
 		lws_buflist_destroy_all_segments(&wsi->http.buflist_post_body);
 #endif
 
-	if (wsi->vhost && wsi->vhost->lserv_wsi == wsi)
-		wsi->vhost->lserv_wsi = NULL;
+	if (wsi->a.vhost && wsi->a.vhost->lserv_wsi == wsi)
+		wsi->a.vhost->lserv_wsi = NULL;
 #if defined(LWS_WITH_CLIENT)
-	if (wsi->vhost)
+	if (wsi->a.vhost)
 		lws_dll2_remove(&wsi->dll_cli_active_conns);
 #endif
-	wsi->context->count_wsi_allocated--;
+	wsi->a.context->count_wsi_allocated--;
 
 	__lws_same_vh_protocol_remove(wsi);
 #if defined(LWS_WITH_CLIENT)
@@ -133,7 +133,7 @@ __lws_reset_wsi(struct lws *wsi)
 #endif
 
 #if defined(LWS_WITH_PEER_LIMITS)
-	lws_peer_track_wsi_close(wsi->context, wsi->peer);
+	lws_peer_track_wsi_close(wsi->a.context, wsi->peer);
 	wsi->peer = NULL;
 #endif
 
@@ -161,17 +161,17 @@ __lws_free_wsi(struct lws *wsi)
 	__lws_reset_wsi(wsi);
 	__lws_wsi_remove_from_sul(wsi);
 
-	if (wsi->context->event_loop_ops->destroy_wsi)
-		wsi->context->event_loop_ops->destroy_wsi(wsi);
+	if (wsi->a.context->event_loop_ops->destroy_wsi)
+		wsi->a.context->event_loop_ops->destroy_wsi(wsi);
 
 	lws_vhost_unbind_wsi(wsi);
 
 	lwsl_debug("%s: %p, remaining wsi %d, tsi fds count %d\n", __func__, wsi,
-			wsi->context->count_wsi_allocated,
-			wsi->context->pt[(int)wsi->tsi].fds_count);
+			wsi->a.context->count_wsi_allocated,
+			wsi->a.context->pt[(int)wsi->tsi].fds_count);
 
 	/* confirm no sul left scheduled in wsi itself */
-	lws_sul_debug_zombies(wsi->context, wsi, sizeof(wsi), __func__);
+	lws_sul_debug_zombies(wsi->a.context, wsi, sizeof(wsi), __func__);
 
 	lws_free(wsi);
 }
@@ -193,8 +193,8 @@ lws_remove_child_from_any_parent(struct lws *wsi)
 			lwsl_info("%s: detach %p from parent %p\n", __func__,
 				  wsi, wsi->parent);
 
-			if (wsi->parent->protocol)
-				wsi->parent->protocol->callback(wsi,
+			if (wsi->parent->a.protocol)
+				wsi->parent->a.protocol->callback(wsi,
 						LWS_CALLBACK_CHILD_CLOSING,
 					       wsi->parent->user_space, wsi, 0);
 
@@ -220,14 +220,14 @@ lws_inform_client_conn_fail(struct lws *wsi, void *arg, size_t len)
 		return;
 
 	wsi->already_did_cce = 1;
-	lws_stats_bump(&wsi->context->pt[(int)wsi->tsi],
+	lws_stats_bump(&wsi->a.context->pt[(int)wsi->tsi],
 		       LWSSTATS_C_CONNS_CLIENT_FAILED, 1);
 
-	if (!wsi->protocol)
+	if (!wsi->a.protocol)
 		return;
 
 	if (!wsi->client_suppress_CONNECTION_ERROR)
-		wsi->protocol->callback(wsi,
+		wsi->a.protocol->callback(wsi,
 					LWS_CALLBACK_CLIENT_CONNECTION_ERROR,
 					wsi->user_space, arg, len);
 }
@@ -270,7 +270,7 @@ __lws_close_free_wsi(struct lws *wsi, enum lws_close_status reason,
 		lwsl_info("%s: wsi %p: going down with stuff in buflist\n",
 				__func__, wsi); }
 
-	context = wsi->context;
+	context = wsi->a.context;
 	pt = &context->pt[(int)wsi->tsi];
 	lws_stats_bump(pt, LWSSTATS_C_API_CLOSE, 1);
 
@@ -305,8 +305,8 @@ __lws_close_free_wsi(struct lws *wsi, enum lws_close_status reason,
 	if (wsi->role_ops == &role_ops_raw_file) {
 		lws_remove_child_from_any_parent(wsi);
 		__remove_wsi_socket_from_fds(wsi);
-		if (wsi->protocol)
-			wsi->protocol->callback(wsi, wsi->role_ops->close_cb[0],
+		if (wsi->a.protocol)
+			wsi->a.protocol->callback(wsi, wsi->role_ops->close_cb[0],
 					wsi->user_space, NULL, 0);
 		goto async_close;
 	}
@@ -409,9 +409,9 @@ __lws_close_free_wsi(struct lws *wsi, enum lws_close_status reason,
 	    lwsi_state(wsi) == LRS_H1C_ISSUE_HANDSHAKE)
 		goto just_kill_connection;
 
-	if (!wsi->told_user_closed && wsi->user_space && wsi->protocol &&
+	if (!wsi->told_user_closed && wsi->user_space && wsi->a.protocol &&
 	    wsi->protocol_bind_balance) {
-		wsi->protocol->callback(wsi,
+		wsi->a.protocol->callback(wsi,
 				wsi->role_ops->protocol_unbind_cb[
 				       !!lwsi_role_server(wsi)],
 				       wsi->user_space, (void *)__func__, 0);
@@ -453,7 +453,7 @@ just_kill_connection:
 #if defined(LWS_WITH_UDP)
 	if (wsi->udp) {
 		/* confirm no sul left scheduled in wsi->udp itself */
-		lws_sul_debug_zombies(wsi->context, wsi->udp,
+		lws_sul_debug_zombies(wsi->a.context, wsi->udp,
 					sizeof(*wsi->udp), "close udp wsi");
 
 		lws_free_set_NULL(wsi->udp);
@@ -466,11 +466,11 @@ just_kill_connection:
 	n = 0;
 
 	if (!wsi->told_user_closed && wsi->user_space &&
-	    wsi->protocol_bind_balance && wsi->protocol) {
+	    wsi->protocol_bind_balance && wsi->a.protocol) {
 		lwsl_debug("%s: %p: DROP_PROTOCOL %s\n", __func__, wsi,
-			   wsi->protocol ? wsi->protocol->name: "NULL");
-		if (wsi->protocol)
-			wsi->protocol->callback(wsi,
+			   wsi->a.protocol ? wsi->a.protocol->name: "NULL");
+		if (wsi->a.protocol)
+			wsi->a.protocol->callback(wsi,
 				wsi->role_ops->protocol_unbind_cb[
 				       !!lwsi_role_server(wsi)],
 				       wsi->user_space, (void *)__func__, 0);
@@ -481,7 +481,7 @@ just_kill_connection:
 	if ((lwsi_state(wsi) == LRS_WAITING_SERVER_REPLY ||
 	     lwsi_state(wsi) == LRS_WAITING_DNS ||
 	     lwsi_state(wsi) == LRS_WAITING_CONNECT) &&
-	     !wsi->already_did_cce && wsi->protocol) {
+	     !wsi->already_did_cce && wsi->a.protocol) {
 		static const char _reason[] = "closed before established";
 
 		lwsl_debug("%s: closing in unestablished state 0x%x\n",
@@ -617,7 +617,7 @@ just_kill_connection:
 		 */
 		ccb = 1;
 
-	pro = wsi->protocol;
+	pro = wsi->a.protocol;
 
 #if defined(LWS_WITH_CLIENT)
 	if (!ccb && (lwsi_state_PRE_CLOSE(wsi) & LWSIFS_NOT_EST) &&
@@ -627,8 +627,8 @@ just_kill_connection:
 #endif
 	if (ccb) {
 
-		if (!wsi->protocol && wsi->vhost && wsi->vhost->protocols)
-			pro = &wsi->vhost->protocols[0];
+		if (!wsi->a.protocol && wsi->a.vhost && wsi->a.vhost->protocols)
+			pro = &wsi->a.vhost->protocols[0];
 
 		if (pro)
 			pro->callback(wsi,
@@ -643,8 +643,8 @@ async_close:
 	lws_remove_child_from_any_parent(wsi);
 	wsi->socket_is_permanently_unusable = 1;
 
-	if (wsi->context->event_loop_ops->wsi_logical_close)
-		if (wsi->context->event_loop_ops->wsi_logical_close(wsi))
+	if (wsi->a.context->event_loop_ops->wsi_logical_close)
+		if (wsi->a.context->event_loop_ops->wsi_logical_close(wsi))
 			return;
 
 	__lws_close_free_wsi_final(wsi);
@@ -664,20 +664,20 @@ __lws_close_free_wsi_final(struct lws *wsi)
 
 		__remove_wsi_socket_from_fds(wsi);
 		if (lws_socket_is_valid(wsi->desc.sockfd))
-			delete_from_fd(wsi->context, wsi->desc.sockfd);
+			delete_from_fd(wsi->a.context, wsi->desc.sockfd);
 
 #if !defined(LWS_PLAT_FREERTOS) && !defined(WIN32) && !defined(LWS_PLAT_OPTEE)
-		delete_from_fdwsi(wsi->context, wsi);
+		delete_from_fdwsi(wsi->a.context, wsi);
 #endif
 
-		sanity_assert_no_sockfd_traces(wsi->context, wsi->desc.sockfd);
+		sanity_assert_no_sockfd_traces(wsi->a.context, wsi->desc.sockfd);
 
 		wsi->desc.sockfd = LWS_SOCK_INVALID;
 	}
 
 	/* outermost destroy notification for wsi (user_space still intact) */
-	if (wsi->vhost)
-		wsi->vhost->protocols[0].callback(wsi, LWS_CALLBACK_WSI_DESTROY,
+	if (wsi->a.vhost)
+		wsi->a.vhost->protocols[0].callback(wsi, LWS_CALLBACK_WSI_DESTROY,
 						  wsi->user_space, NULL, 0);
 
 #ifdef LWS_WITH_CGI
@@ -689,7 +689,7 @@ __lws_close_free_wsi_final(struct lws *wsi)
 #endif
 
 	__lws_wsi_remove_from_sul(wsi);
-	sanity_assert_no_wsi_traces(wsi->context, wsi);
+	sanity_assert_no_wsi_traces(wsi->a.context, wsi);
 	__lws_free_wsi(wsi);
 }
 
@@ -697,7 +697,7 @@ __lws_close_free_wsi_final(struct lws *wsi)
 void
 lws_close_free_wsi(struct lws *wsi, enum lws_close_status reason, const char *caller)
 {
-	struct lws_context_per_thread *pt = &wsi->context->pt[(int)wsi->tsi];
+	struct lws_context_per_thread *pt = &wsi->a.context->pt[(int)wsi->tsi];
 
 	lws_pt_lock(pt, __func__);
 	__lws_close_free_wsi(wsi, reason, caller);
diff --git a/lib/core-net/connect.c b/lib/core-net/connect.c
index 1fae6c799..a2109007b 100644
--- a/lib/core-net/connect.c
+++ b/lib/core-net/connect.c
@@ -69,7 +69,7 @@ lws_client_connect_via_info(const struct lws_client_connect_info *i)
 	else
 		wsi->keep_warm_secs = 5;
 
-	wsi->context = i->context;
+	wsi->a.context = i->context;
 	wsi->desc.sockfd = LWS_SOCK_INVALID;
 	wsi->seq = i->seq;
 	wsi->flags = i->ssl_connection;
@@ -86,7 +86,7 @@ lws_client_connect_via_info(const struct lws_client_connect_info *i)
 	if (i->ssl_connection & LCCSCF_WAKE_SUSPEND__VALIDITY)
 		wsi->conn_validity_wakesuspend = 1;
 
-	wsi->vhost = NULL;
+	wsi->a.vhost = NULL;
 	if (!i->vhost) {
 		struct lws_vhost *v = i->context->vhost_list;
 		if (v && !strcmp(v->name, "system"))
@@ -95,14 +95,14 @@ lws_client_connect_via_info(const struct lws_client_connect_info *i)
 	} else
 		lws_vhost_bind_wsi(i->vhost, wsi);
 
-	if (!wsi->vhost) {
+	if (!wsi->a.vhost) {
 		lwsl_err("%s: No vhost in the context\n", __func__);
 
 		goto bail;
 	}
 
 #if LWS_MAX_SMP > 1
-	tid = wsi->vhost->protocols[0].callback(wsi, LWS_CALLBACK_GET_THREAD_ID,
+	tid = wsi->a.vhost->protocols[0].callback(wsi, LWS_CALLBACK_GET_THREAD_ID,
 						NULL, NULL, 0);
 #endif
 
@@ -164,7 +164,7 @@ lws_client_connect_via_info(const struct lws_client_connect_info *i)
 	wsi->txc.manual_initial_tx_credit = (int32_t)i->manual_initial_tx_credit;
 #endif
 
-	wsi->protocol = &wsi->vhost->protocols[0];
+	wsi->a.protocol = &wsi->a.vhost->protocols[0];
 	wsi->client_pipeline = !!(i->ssl_connection & LCCSCF_PIPELINE);
 	wsi->client_no_follow_redirect = !!(i->ssl_connection &
 					    LCCSCF_HTTP_NO_FOLLOW_REDIRECT);
@@ -180,8 +180,8 @@ lws_client_connect_via_info(const struct lws_client_connect_info *i)
 	}
 
 	if (local) {
-		lwsl_info("%s: vh %s protocol binding to %s\n", __func__, wsi->vhost->name, local);
-		p = lws_vhost_name_to_protocol(wsi->vhost, local);
+		lwsl_info("%s: vh %s protocol binding to %s\n", __func__, wsi->a.vhost->name, local);
+		p = lws_vhost_name_to_protocol(wsi->a.vhost, local);
 		if (p)
 			lws_bind_protocol(wsi, p, __func__);
 		else
@@ -189,7 +189,7 @@ lws_client_connect_via_info(const struct lws_client_connect_info *i)
 
 		lwsl_info("%s: wsi %p: %s %s entry\n",
 			    __func__, wsi, wsi->role_ops->name,
-			    wsi->protocol ? wsi->protocol->name : "none");
+			    wsi->a.protocol ? wsi->a.protocol->name : "none");
 	}
 
 	/*
@@ -249,7 +249,7 @@ lws_client_connect_via_info(const struct lws_client_connect_info *i)
 	/* all the pointers default to NULL, but no need to zero the args */
 	memset(wsi->stash, 0, sizeof(*wsi->stash));
 
-	wsi->opaque_user_data = wsi->stash->opaque_user_data =
+	wsi->a.opaque_user_data = wsi->stash->opaque_user_data =
 		i->opaque_user_data;
 	pc = (char *)&wsi->stash[1];
 
@@ -313,9 +313,9 @@ lws_client_connect_via_info(const struct lws_client_connect_info *i)
 	     !strcmp(i->local_protocol_name, "raw-proxy"))) {
 		lwsl_debug("%s: wsi %p: adoption cb %d to %s %s\n", __func__,
 			   wsi, wsi->role_ops->adoption_cb[0],
-			   wsi->role_ops->name, wsi->protocol->name);
+			   wsi->role_ops->name, wsi->a.protocol->name);
 
-		wsi->protocol->callback(wsi, wsi->role_ops->adoption_cb[0],
+		wsi->a.protocol->callback(wsi, wsi->role_ops->adoption_cb[0],
 				wsi->user_space, NULL, 0);
 	}
 
diff --git a/lib/core-net/network.c b/lib/core-net/network.c
index af44a3979..a6d6691d4 100644
--- a/lib/core-net/network.c
+++ b/lib/core-net/network.c
@@ -153,7 +153,7 @@ lws_get_peer_addresses(struct lws *wsi, lws_sockfd_type fd, char *name,
 	name[0] = '\0';
 
 #ifdef LWS_WITH_IPV6
-	if (LWS_IPV6_ENABLED(wsi->vhost)) {
+	if (LWS_IPV6_ENABLED(wsi->a.vhost)) {
 		len = sizeof(sin6);
 		p = &sin6;
 	} else
@@ -168,7 +168,7 @@ lws_get_peer_addresses(struct lws *wsi, lws_sockfd_type fd, char *name,
 		goto bail;
 	}
 
-	lws_get_addresses(wsi->vhost, p, name, name_len, rip, rip_len);
+	lws_get_addresses(wsi->a.vhost, p, name, name_len, rip, rip_len);
 
 bail:
 #endif
@@ -430,7 +430,7 @@ int
 lws_retry_sul_schedule_retry_wsi(struct lws *wsi, lws_sorted_usec_list_t *sul,
 				 sul_cb_t cb, uint16_t *ctry)
 {
-	return lws_retry_sul_schedule(wsi->context, wsi->tsi, sul,
+	return lws_retry_sul_schedule(wsi->a.context, wsi->tsi, sul,
 				      wsi->retry_policy, cb, ctry);
 }
 
diff --git a/lib/core-net/output.c b/lib/core-net/output.c
index 7c25ae12f..269a6e59d 100644
--- a/lib/core-net/output.c
+++ b/lib/core-net/output.c
@@ -31,7 +31,7 @@ int
 lws_issue_raw(struct lws *wsi, unsigned char *buf, size_t len)
 {
 	struct lws_context *context = lws_get_context(wsi);
-	struct lws_context_per_thread *pt = &wsi->context->pt[(int)wsi->tsi];
+	struct lws_context_per_thread *pt = &wsi->a.context->pt[(int)wsi->tsi];
 	size_t real_len = len;
 	unsigned int n, m;
 
@@ -47,8 +47,8 @@ lws_issue_raw(struct lws *wsi, unsigned char *buf, size_t len)
 		lwsl_hexdump_level(LLL_INFO, buf, len);
 		lwsl_info("** %p: vh: %s, prot: %s, role %s: "
 			  "Inefficient back-to-back write of %lu detected...\n",
-			  wsi, wsi->vhost ? wsi->vhost->name : "no vhost",
-			  wsi->protocol->name, wsi->role_ops->name,
+			  wsi, wsi->a.vhost ? wsi->a.vhost->name : "no vhost",
+			  wsi->a.protocol->name, wsi->role_ops->name,
 			  (unsigned long)len);
 	}
 
@@ -65,8 +65,8 @@ lws_issue_raw(struct lws *wsi, unsigned char *buf, size_t len)
 
 	if (buf && lws_has_buffered_out(wsi)) {
 		lwsl_info("** %p: vh: %s, prot: %s, incr buflist_out by %lu\n",
-			  wsi, wsi->vhost ? wsi->vhost->name : "no vhost",
-			  wsi->protocol->name, (unsigned long)len);
+			  wsi, wsi->a.vhost ? wsi->a.vhost->name : "no vhost",
+			  wsi->a.protocol->name, (unsigned long)len);
 
 		/*
 		 * already buflist ahead of this, add it on the tail of the
@@ -97,10 +97,10 @@ lws_issue_raw(struct lws *wsi, unsigned char *buf, size_t len)
 		lwsl_err("%s: invalid sock %p\n", __func__, wsi);
 
 	/* limit sending */
-	if (wsi->protocol->tx_packet_size)
-		n = (int)wsi->protocol->tx_packet_size;
+	if (wsi->a.protocol->tx_packet_size)
+		n = (int)wsi->a.protocol->tx_packet_size;
 	else {
-		n = (int)wsi->protocol->rx_buffer_size;
+		n = (int)wsi->a.protocol->rx_buffer_size;
 		if (!n)
 			n = context->pt_serv_buf_size;
 	}
@@ -228,7 +228,7 @@ int
 lws_write(struct lws *wsi, unsigned char *buf, size_t len,
 	  enum lws_write_protocol wp)
 {
-	struct lws_context_per_thread *pt = &wsi->context->pt[(int)wsi->tsi];
+	struct lws_context_per_thread *pt = &wsi->a.context->pt[(int)wsi->tsi];
 #if defined(LWS_WITH_DETAILED_LATENCY)
 	lws_usec_t us;
 #endif
@@ -248,8 +248,8 @@ lws_write(struct lws *wsi, unsigned char *buf, size_t len,
 	wsi->http.access_log.sent += len;
 #endif
 #if defined(LWS_WITH_SERVER_STATUS)
-	if (wsi->vhost)
-		wsi->vhost->conn_stats.tx += len;
+	if (wsi->a.vhost)
+		wsi->a.vhost->conn_stats.tx += len;
 #endif
 #if defined(LWS_WITH_DETAILED_LATENCY)
 	us = lws_now_usecs();
@@ -264,7 +264,7 @@ lws_write(struct lws *wsi, unsigned char *buf, size_t len,
 		return m;
 
 #if defined(LWS_WITH_DETAILED_LATENCY)
-	if (wsi->context->detailed_latency_cb) {
+	if (wsi->a.context->detailed_latency_cb) {
 		wsi->detlat.req_size = len;
 		wsi->detlat.acc_size = m;
 		wsi->detlat.type = LDLT_WRITE;
@@ -274,7 +274,7 @@ lws_write(struct lws *wsi, unsigned char *buf, size_t len,
 		else
 			wsi->detlat.latencies[LAT_DUR_PROXY_PROXY_REQ_TO_WRITE] = 0;
 		wsi->detlat.latencies[LAT_DUR_USERCB] = lws_now_usecs() - us;
-		lws_det_lat_cb(wsi->context, &wsi->detlat);
+		lws_det_lat_cb(wsi->a.context, &wsi->detlat);
 
 	}
 #endif
@@ -285,7 +285,7 @@ lws_write(struct lws *wsi, unsigned char *buf, size_t len,
 int
 lws_ssl_capable_read_no_ssl(struct lws *wsi, unsigned char *buf, int len)
 {
-	struct lws_context *context = wsi->context;
+	struct lws_context *context = wsi->a.context;
 	struct lws_context_per_thread *pt = &context->pt[(int)wsi->tsi];
 	int n = 0;
 
@@ -314,8 +314,8 @@ lws_ssl_capable_read_no_ssl(struct lws *wsi, unsigned char *buf, int len)
 			return LWS_SSL_CAPABLE_ERROR;
 
 #if defined(LWS_WITH_SERVER_STATUS)
-		if (wsi->vhost)
-			wsi->vhost->conn_stats.rx += n;
+		if (wsi->a.vhost)
+			wsi->a.vhost->conn_stats.rx += n;
 #endif
 		lws_stats_bump(pt, LWSSTATS_B_READ, n);
 
@@ -341,15 +341,15 @@ lws_ssl_capable_write_no_ssl(struct lws *wsi, unsigned char *buf, int len)
 
 #if defined(LWS_WITH_UDP)
 	if (lws_wsi_is_udp(wsi)) {
-		if (wsi->context->udp_loss_sim_tx_pc) {
+		if (wsi->a.context->udp_loss_sim_tx_pc) {
 			uint16_t u16;
 			/*
 			 * We should randomly drop some of these
 			 */
 
-			if (lws_get_random(wsi->context, &u16, 2) == 2 &&
+			if (lws_get_random(wsi->a.context, &u16, 2) == 2 &&
 			    ((u16 * 100) / 0xffff) <=
-				    wsi->context->udp_loss_sim_tx_pc) {
+				    wsi->a.context->udp_loss_sim_tx_pc) {
 				lwsl_warn("%s: dropping udp tx\n", __func__);
 				/* pretend it was sent */
 				n = len;
diff --git a/lib/core-net/pollfd.c b/lib/core-net/pollfd.c
index f27c404c0..9724f60aa 100644
--- a/lib/core-net/pollfd.c
+++ b/lib/core-net/pollfd.c
@@ -67,7 +67,7 @@ _lws_change_pollfd(struct lws *wsi, int _and, int _or, struct lws_pollargs *pa)
 		return 0;
 	}
 
-	context = wsi->context;
+	context = wsi->a.context;
 	pt = &context->pt[(int)wsi->tsi];
 
 	assert(wsi->position_in_fds_table < (int)pt->fds_count);
@@ -157,8 +157,8 @@ _lws_change_pollfd(struct lws *wsi, int _and, int _or, struct lws_pollargs *pa)
 
 #if defined(LWS_WITH_EXTERNAL_POLL)
 
-	if (wsi->vhost &&
-	    wsi->vhost->protocols[0].callback(wsi,
+	if (wsi->a.vhost &&
+	    wsi->a.vhost->protocols[0].callback(wsi,
 			    	    	      LWS_CALLBACK_CHANGE_MODE_POLL_FD,
 					      wsi->user_space, (void *)pa, 0)) {
 		ret = -1;
@@ -200,8 +200,8 @@ _lws_change_pollfd(struct lws *wsi, int _and, int _or, struct lws_pollargs *pa)
 			goto bail;
 		}
 		sampled_tid = pt->service_tid;
-		if (sampled_tid && wsi->vhost) {
-			tid = wsi->vhost->protocols[0].callback(wsi,
+		if (sampled_tid && wsi->a.vhost) {
+			tid = wsi->a.vhost->protocols[0].callback(wsi,
 				     LWS_CALLBACK_GET_THREAD_ID, NULL, NULL, 0);
 			if (tid == -1) {
 				ret = -1;
@@ -283,7 +283,7 @@ __insert_wsi_socket_into_fds(struct lws_context *context, struct lws *wsi)
 	}
 
 #if !defined(_WIN32)
-	if (!wsi->context->max_fds_unrelated_to_ulimit &&
+	if (!wsi->a.context->max_fds_unrelated_to_ulimit &&
 	    wsi->desc.sockfd - lws_plat_socket_offset() >= context->max_fds) {
 		lwsl_err("Socket fd %d is too high (%d) offset %d\n",
 			 wsi->desc.sockfd, context->max_fds,
@@ -293,13 +293,13 @@ __insert_wsi_socket_into_fds(struct lws_context *context, struct lws *wsi)
 #endif
 
 	assert(wsi);
-	assert(wsi->event_pipe || wsi->vhost);
+	assert(wsi->event_pipe || wsi->a.vhost);
 	assert(lws_socket_is_valid(wsi->desc.sockfd));
 
 #if defined(LWS_WITH_EXTERNAL_POLL)
 
-	if (wsi->vhost &&
-	    wsi->vhost->protocols[0].callback(wsi, LWS_CALLBACK_LOCK_POLL,
+	if (wsi->a.vhost &&
+	    wsi->a.vhost->protocols[0].callback(wsi, LWS_CALLBACK_LOCK_POLL,
 					   wsi->user_space, (void *) &pa, 1))
 		return -1;
 #endif
@@ -320,8 +320,8 @@ __insert_wsi_socket_into_fds(struct lws_context *context, struct lws *wsi)
 #if defined(LWS_WITH_EXTERNAL_POLL)
 
 	/* external POLL support via protocol 0 */
-	if (wsi->vhost &&
-	    wsi->vhost->protocols[0].callback(wsi, LWS_CALLBACK_ADD_POLL_FD,
+	if (wsi->a.vhost &&
+	    wsi->a.vhost->protocols[0].callback(wsi, LWS_CALLBACK_ADD_POLL_FD,
 					   wsi->user_space, (void *) &pa, 0))
 		ret =  -1;
 #endif
@@ -332,8 +332,8 @@ __insert_wsi_socket_into_fds(struct lws_context *context, struct lws *wsi)
 #endif
 
 #if defined(LWS_WITH_EXTERNAL_POLL)
-	if (wsi->vhost &&
-	    wsi->vhost->protocols[0].callback(wsi, LWS_CALLBACK_UNLOCK_POLL,
+	if (wsi->a.vhost &&
+	    wsi->a.vhost->protocols[0].callback(wsi, LWS_CALLBACK_UNLOCK_POLL,
 					   wsi->user_space, (void *)&pa, 1))
 		ret = -1;
 #endif
@@ -346,7 +346,7 @@ __insert_wsi_socket_into_fds(struct lws_context *context, struct lws *wsi)
 int
 __remove_wsi_socket_from_fds(struct lws *wsi)
 {
-	struct lws_context *context = wsi->context;
+	struct lws_context *context = wsi->a.context;
 #if defined(LWS_WITH_EXTERNAL_POLL)
 	struct lws_pollargs pa = { wsi->desc.sockfd, 0, 0 };
 #endif
@@ -357,7 +357,7 @@ __remove_wsi_socket_from_fds(struct lws *wsi)
 //	__dump_fds(pt, "pre remove");
 
 #if !defined(_WIN32)
-	if (!wsi->context->max_fds_unrelated_to_ulimit &&
+	if (!wsi->a.context->max_fds_unrelated_to_ulimit &&
 	    wsi->desc.sockfd - lws_plat_socket_offset() > context->max_fds) {
 		lwsl_err("fd %d too high (%d)\n", wsi->desc.sockfd,
 			 context->max_fds);
@@ -366,8 +366,8 @@ __remove_wsi_socket_from_fds(struct lws *wsi)
 	}
 #endif
 #if defined(LWS_WITH_EXTERNAL_POLL)
-	if (wsi->vhost && wsi->vhost->protocols &&
-	    wsi->vhost->protocols[0].callback(wsi, LWS_CALLBACK_LOCK_POLL,
+	if (wsi->a.vhost && wsi->a.vhost->protocols &&
+	    wsi->a.vhost->protocols[0].callback(wsi, LWS_CALLBACK_LOCK_POLL,
 					   wsi->user_space, (void *)&pa, 1))
 		return -1;
 #endif
@@ -428,8 +428,8 @@ __remove_wsi_socket_from_fds(struct lws *wsi)
 
 #if defined(LWS_WITH_EXTERNAL_POLL)
 	/* remove also from external POLL support via protocol 0 */
-	if (lws_socket_is_valid(wsi->desc.sockfd) && wsi->vhost &&
-	    wsi->vhost->protocols[0].callback(wsi, LWS_CALLBACK_DEL_POLL_FD,
+	if (lws_socket_is_valid(wsi->desc.sockfd) && wsi->a.vhost &&
+	    wsi->a.vhost->protocols[0].callback(wsi, LWS_CALLBACK_DEL_POLL_FD,
 					      wsi->user_space, (void *) &pa, 0))
 		ret = -1;
 #endif
@@ -442,8 +442,8 @@ __remove_wsi_socket_from_fds(struct lws *wsi)
 #endif
 
 #if defined(LWS_WITH_EXTERNAL_POLL)
-	if (wsi->vhost &&
-	    wsi->vhost->protocols[0].callback(wsi, LWS_CALLBACK_UNLOCK_POLL,
+	if (wsi->a.vhost &&
+	    wsi->a.vhost->protocols[0].callback(wsi, LWS_CALLBACK_UNLOCK_POLL,
 					      wsi->user_space, (void *) &pa, 1))
 		ret = -1;
 #endif
@@ -460,7 +460,7 @@ __lws_change_pollfd(struct lws *wsi, int _and, int _or)
 	struct lws_pollargs pa;
 	int ret = 0;
 
-	if (!wsi || (!wsi->protocol && !wsi->event_pipe) ||
+	if (!wsi || (!wsi->a.protocol && !wsi->event_pipe) ||
 	    wsi->position_in_fds_table == LWS_NO_FDS_POS)
 		return 0;
 
@@ -469,8 +469,8 @@ __lws_change_pollfd(struct lws *wsi, int _and, int _or)
 		return 1;
 
 #if defined(LWS_WITH_EXTERNAL_POLL)
-	if (wsi->vhost &&
-	    wsi->vhost->protocols[0].callback(wsi, LWS_CALLBACK_LOCK_POLL,
+	if (wsi->a.vhost &&
+	    wsi->a.vhost->protocols[0].callback(wsi, LWS_CALLBACK_LOCK_POLL,
 					      wsi->user_space, (void *) &pa, 0))
 		return -1;
 #endif
@@ -478,8 +478,8 @@ __lws_change_pollfd(struct lws *wsi, int _and, int _or)
 	ret = _lws_change_pollfd(wsi, _and, _or, &pa);
 
 #if defined(LWS_WITH_EXTERNAL_POLL)
-	if (wsi->vhost &&
-	    wsi->vhost->protocols[0].callback(wsi, LWS_CALLBACK_UNLOCK_POLL,
+	if (wsi->a.vhost &&
+	    wsi->a.vhost->protocols[0].callback(wsi, LWS_CALLBACK_UNLOCK_POLL,
 					   wsi->user_space, (void *) &pa, 0))
 		ret = -1;
 #endif
@@ -493,7 +493,7 @@ lws_change_pollfd(struct lws *wsi, int _and, int _or)
 	struct lws_context_per_thread *pt;
 	int ret = 0;
 
-	pt = &wsi->context->pt[(int)wsi->tsi];
+	pt = &wsi->a.context->pt[(int)wsi->tsi];
 
 	lws_pt_lock(pt, __func__);
 	ret = __lws_change_pollfd(wsi, _and, _or);
@@ -514,7 +514,7 @@ lws_callback_on_writable(struct lws *wsi)
 	if (wsi->socket_is_permanently_unusable)
 		return 0;
 
-	pt = &wsi->context->pt[(int)wsi->tsi];
+	pt = &wsi->a.context->pt[(int)wsi->tsi];
 
 #if defined(LWS_WITH_DETAILED_LATENCY)
 	if (!wsi->detlat.earliest_write_req)
@@ -564,35 +564,35 @@ lws_callback_on_writable(struct lws *wsi)
 void
 lws_same_vh_protocol_insert(struct lws *wsi, int n)
 {
-	lws_vhost_lock(wsi->vhost);
+	lws_vhost_lock(wsi->a.vhost);
 
 	lws_dll2_remove(&wsi->same_vh_protocol);
 	lws_dll2_add_head(&wsi->same_vh_protocol,
-			  &wsi->vhost->same_vh_protocol_owner[n]);
+			  &wsi->a.vhost->same_vh_protocol_owner[n]);
 
 	wsi->bound_vhost_index = n;
 
-	lws_vhost_unlock(wsi->vhost);
+	lws_vhost_unlock(wsi->a.vhost);
 }
 
 void
 __lws_same_vh_protocol_remove(struct lws *wsi)
 {
-	if (wsi->vhost && wsi->vhost->same_vh_protocol_owner)
+	if (wsi->a.vhost && wsi->a.vhost->same_vh_protocol_owner)
 		lws_dll2_remove(&wsi->same_vh_protocol);
 }
 
 void
 lws_same_vh_protocol_remove(struct lws *wsi)
 {
-	if (!wsi->vhost)
+	if (!wsi->a.vhost)
 		return;
 
-	lws_vhost_lock(wsi->vhost);
+	lws_vhost_lock(wsi->a.vhost);
 
 	__lws_same_vh_protocol_remove(wsi);
 
-	lws_vhost_unlock(wsi->vhost);
+	lws_vhost_unlock(wsi->a.vhost);
 }
 
 
@@ -618,7 +618,7 @@ lws_callback_on_writable_all_protocol_vhost(const struct lws_vhost *vhost,
 			lws_dll2_get_head(&vhost->same_vh_protocol_owner[n])) {
 		wsi = lws_container_of(d, struct lws, same_vh_protocol);
 
-		assert(wsi->protocol == protocol);
+		assert(wsi->a.protocol == protocol);
 		lws_callback_on_writable(wsi);
 
 	} lws_end_foreach_dll_safe(d, d1);
diff --git a/lib/core-net/private-lib-core-net.h b/lib/core-net/private-lib-core-net.h
index 7466dc931..ee41f804c 100644
--- a/lib/core-net/private-lib-core-net.h
+++ b/lib/core-net/private-lib-core-net.h
@@ -390,11 +390,13 @@ struct lws_context_per_thread {
 	lws_sorted_usec_list_t sul_peer_limits;
 #endif
 
+#if !defined(LWS_PLAT_FREERTOS)
+	struct lws *fake_wsi;   /* used for callbacks where there's no wsi */
+#endif
+
 #if defined(LWS_WITH_TLS)
 	struct lws_pt_tls tls;
 #endif
-	struct lws *fake_wsi;	/* used for callbacks where there's no wsi */
-
 	struct lws_context *context;
 
 	/*
@@ -638,7 +640,50 @@ lws_wsi_mux_apply_queue(struct lws *wsi);
  * struct lws
  */
 
+/*
+ * These pieces are very commonly used (via accessors) in user protocol handlers
+ * and have to be valid, even in the case no real wsi is available for the cb.
+ *
+ * We put all this category of pointers in there and compose it at the top of
+ * struct lws, so a dummy wsi providing these only needs to be this big, while
+ * still being castable for being a struct wsi *
+ */
+
+struct lws_a {
+	struct lws_context		*context;
+	struct lws_vhost		*vhost;
+	const struct lws_protocols	*protocol;
+	void				*opaque_user_data;
+};
+
+/*
+ * For RTOS-class platforms, their code is relatively new, post-minimal examples
+ * and tend to not have legacy user protocol handler baggage touching unexpected
+ * things in fakewsi unconditionally... we can use an lws_a on the stack and
+ * don't need to define the rest of the wsi content, just cast it, this saves
+ * a wsi footprint in heap (typ 800 bytes nowadays even on RTOS).
+ *
+ * For other platforms that have been around for years and have thousands of
+ * different user protocol handler implementations, it's likely some of them
+ * will be touching the struct lws content unconditionally in the handler even
+ * when we are calling back with a non wsi-specific reason, and may react badly
+ * to it being garbage.  So continue to implement those as a full, zero-ed down
+ * prepared fakewsi on heap at context creation time.
+ */
+
+#if defined(LWS_PLAT_FREERTOS)
+#define lws_fakewsi_def_plwsa(pt) struct lws_a lwsa, *plwsa = &lwsa
+#else
+#define lws_fakewsi_def_plwsa(pt) struct lws_a *plwsa = &(pt)->fake_wsi->a
+#endif
+/* since we reuse the pt version, also correct to zero down the lws_a part */
+#define lws_fakewsi_prep_plwsa_ctx(_c) \
+		memset(plwsa, 0, sizeof(*plwsa)); plwsa->context = _c
+
 struct lws {
+
+	struct lws_a			a;
+
 	/* structs */
 
 #if defined(LWS_ROLE_H1) || defined(LWS_ROLE_H2)
@@ -699,13 +744,10 @@ struct lws {
 #endif
 	/* pointers */
 
-	struct lws_context		*context;
-	struct lws_vhost		*vhost;
 	struct lws			*parent; /* points to parent, if any */
 	struct lws			*child_list; /* points to first child */
 	struct lws			*sibling_list; /* subsequent children at same level */
 	const struct lws_role_ops	*role_ops;
-	const struct lws_protocols	*protocol;
 	struct lws_sequencer		*seq;	/* associated sequencer if any */
 	const lws_retry_bo_t		*retry_policy;
 
@@ -728,7 +770,6 @@ struct lws {
 #endif
 	void				*user_space;
 	void				*opaque_parent_data;
-	void				*opaque_user_data;
 
 	struct lws_buflist		*buflist; /* input-side buflist */
 	struct lws_buflist		*buflist_out; /* output-side buflist */
diff --git a/lib/core-net/service.c b/lib/core-net/service.c
index b13a14ddc..279020eb1 100644
--- a/lib/core-net/service.c
+++ b/lib/core-net/service.c
@@ -27,7 +27,7 @@
 int
 lws_callback_as_writeable(struct lws *wsi)
 {
-	struct lws_context_per_thread *pt = &wsi->context->pt[(int)wsi->tsi];
+	struct lws_context_per_thread *pt = &wsi->a.context->pt[(int)wsi->tsi];
 	int n, m;
 
 	lws_stats_bump(pt, LWSSTATS_C_WRITEABLE_CB, 1);
@@ -42,7 +42,7 @@ lws_callback_as_writeable(struct lws *wsi)
 	}
 #endif
 #if defined(LWS_WITH_DETAILED_LATENCY)
-	if (wsi->context->detailed_latency_cb && lwsi_state_est(wsi)) {
+	if (wsi->a.context->detailed_latency_cb && lwsi_state_est(wsi)) {
 		lws_usec_t us = lws_now_usecs();
 
 		wsi->detlat.earliest_write_req_pre_write =
@@ -53,7 +53,7 @@ lws_callback_as_writeable(struct lws *wsi)
 	}
 #endif
 	n = wsi->role_ops->writeable_cb[lwsi_role_server(wsi)];
-	m = user_callback_handle_rxflow(wsi->protocol->callback,
+	m = user_callback_handle_rxflow(wsi->a.protocol->callback,
 					wsi, (enum lws_callback_reasons) n,
 					wsi->user_space, NULL, 0);
 
@@ -245,7 +245,7 @@ bail_die:
 int
 lws_rxflow_cache(struct lws *wsi, unsigned char *buf, int n, int len)
 {
-	struct lws_context_per_thread *pt = &wsi->context->pt[(int)wsi->tsi];
+	struct lws_context_per_thread *pt = &wsi->a.context->pt[(int)wsi->tsi];
 	uint8_t *buffered;
 	size_t blen;
 	int ret = LWSRXFC_CACHED, m;
@@ -371,8 +371,8 @@ lws_buflist_aware_read(struct lws_context_per_thread *pt, struct lws *wsi,
 	if (!ebuf->token)
 		ebuf->token = pt->serv_buf + LWS_PRE;
 	if (!ebuf->len ||
-	    (unsigned int)ebuf->len > wsi->context->pt_serv_buf_size - LWS_PRE)
-		ebuf->len = wsi->context->pt_serv_buf_size - LWS_PRE;
+	    (unsigned int)ebuf->len > wsi->a.context->pt_serv_buf_size - LWS_PRE)
+		ebuf->len = wsi->a.context->pt_serv_buf_size - LWS_PRE;
 
 	e = ebuf->len;
 	ep = ebuf->token;
@@ -450,7 +450,7 @@ int
 lws_buflist_aware_finished_consuming(struct lws *wsi, struct lws_tokens *ebuf,
 				     int used, int buffered, const char *hint)
 {
-	struct lws_context_per_thread *pt = &wsi->context->pt[(int)wsi->tsi];
+	struct lws_context_per_thread *pt = &wsi->a.context->pt[(int)wsi->tsi];
 	int m;
 
 	//lwsl_debug("%s %s consuming buffered %d used %zu / %zu\n", __func__, hint,
diff --git a/lib/core-net/socks5-client.c b/lib/core-net/socks5-client.c
index 0e2c51485..6042eb942 100644
--- a/lib/core-net/socks5-client.c
+++ b/lib/core-net/socks5-client.c
@@ -99,7 +99,7 @@ int
 lws_socks5c_generate_msg(struct lws *wsi, enum socks_msg_type type,
 			 ssize_t *msg_len)
 {
-	struct lws_context *context = wsi->context;
+	struct lws_context *context = wsi->a.context;
 	struct lws_context_per_thread *pt = &context->pt[(int)wsi->tsi];
 	uint8_t *p = pt->serv_buf, *end = &p[context->pt_serv_buf_size];
 	ssize_t n, passwd_len;
@@ -121,8 +121,8 @@ lws_socks5c_generate_msg(struct lws *wsi, enum socks_msg_type type,
 		break;
 
 	case SOCKS_MSG_USERNAME_PASSWORD:
-		n = strlen(wsi->vhost->socks_user);
-		passwd_len = strlen(wsi->vhost->socks_password);
+		n = strlen(wsi->a.vhost->socks_user);
+		passwd_len = strlen(wsi->a.vhost->socks_password);
 
 		if (n > 254 || passwd_len > 254)
 			return 1;
@@ -136,14 +136,14 @@ lws_socks5c_generate_msg(struct lws *wsi, enum socks_msg_type type,
 		/* length of the user name */
 		*p++ = n;
 		/* user name */
-		memcpy(p, wsi->vhost->socks_user, n);
+		memcpy(p, wsi->a.vhost->socks_user, n);
 		p += n;
 
 		/* length of the password */
 		*p++ = passwd_len;
 
 		/* password */
-		memcpy(p, wsi->vhost->socks_password, passwd_len);
+		memcpy(p, wsi->a.vhost->socks_password, passwd_len);
 		p += passwd_len;
 		break;
 
@@ -219,12 +219,12 @@ lws_socks5c_ads_server(struct lws_vhost *vh,
 int
 lws_socks5c_greet(struct lws *wsi, const char **pcce)
 {
-	struct lws_context_per_thread *pt = &wsi->context->pt[(int)wsi->tsi];
+	struct lws_context_per_thread *pt = &wsi->a.context->pt[(int)wsi->tsi];
 	ssize_t plen;
 	int n;
 
 	/* socks proxy */
-	if (!wsi->vhost->socks_proxy_port)
+	if (!wsi->a.vhost->socks_proxy_port)
 		return 0;
 
 	if (lws_socks5c_generate_msg(wsi, SOCKS_MSG_GREETING, &plen)) {
@@ -241,7 +241,7 @@ lws_socks5c_greet(struct lws *wsi, const char **pcce)
 	}
 
 	lws_set_timeout(wsi, PENDING_TIMEOUT_AWAITING_SOCKS_GREETING_REPLY,
-			wsi->context->timeout_secs);
+			wsi->a.context->timeout_secs);
 
 	lwsi_set_state(wsi, LRS_WAITING_SOCKS_GREETING_REPLY);
 
@@ -252,7 +252,7 @@ int
 lws_socks5c_handle_state(struct lws *wsi, struct lws_pollfd *pollfd,
 			 const char **pcce)
 {
-	struct lws_context_per_thread *pt = &wsi->context->pt[(int)wsi->tsi];
+	struct lws_context_per_thread *pt = &wsi->a.context->pt[(int)wsi->tsi];
 	int conn_mode = 0, pending_timeout = 0;
 	ssize_t len;
 	int n;
@@ -267,7 +267,7 @@ lws_socks5c_handle_state(struct lws *wsi, struct lws_pollfd *pollfd,
 	}
 
 	n = recv(wsi->desc.sockfd, pt->serv_buf,
-		 wsi->context->pt_serv_buf_size, 0);
+		 wsi->a.context->pt_serv_buf_size, 0);
 	if (n < 0) {
 		if (LWS_ERRNO == LWS_EAGAIN) {
 			lwsl_debug("SOCKS read EAGAIN, retrying\n");
@@ -339,7 +339,7 @@ socks_send:
 		}
 
 		lws_set_timeout(wsi, pending_timeout,
-				wsi->context->timeout_secs);
+				wsi->a.context->timeout_secs);
 		lwsi_set_state(wsi, conn_mode);
 		break;
 
@@ -359,13 +359,13 @@ socks_reply_fail:
 #if defined(LWS_ROLE_H1) || defined(LWS_ROLE_H2)
 		if (lwsi_role_http(wsi) &&
 		    lws_hdr_simple_create(wsi, _WSI_TOKEN_CLIENT_PEER_ADDRESS,
-					  wsi->vhost->socks_proxy_address)) {
+					  wsi->a.vhost->socks_proxy_address)) {
 			*pcce = "socks connect fail";
 			return LW5CHS_RET_BAIL3;
 		}
 #endif
 
-		wsi->c_port = wsi->vhost->socks_proxy_port;
+		wsi->c_port = wsi->a.vhost->socks_proxy_port;
 
 		/* clear his proxy connection timeout */
 		lws_set_timeout(wsi, NO_PENDING_TIMEOUT, 0);
diff --git a/lib/core-net/vhost.c b/lib/core-net/vhost.c
index 993a50c69..f73790fb5 100644
--- a/lib/core-net/vhost.c
+++ b/lib/core-net/vhost.c
@@ -147,18 +147,18 @@ lws_role_call_adoption_bind(struct lws *wsi, int type, const char *prot)
 	 * if the vhost is told to bind accepted sockets to a given role,
 	 * then look it up by name and try to bind to the specific role.
 	 */
-	if (lws_check_opt(wsi->vhost->options,
+	if (lws_check_opt(wsi->a.vhost->options,
 			  LWS_SERVER_OPTION_ADOPT_APPLY_LISTEN_ACCEPT_CONFIG) &&
-	    wsi->vhost->listen_accept_role) {
+	    wsi->a.vhost->listen_accept_role) {
 		const struct lws_role_ops *role =
-			lws_role_by_name(wsi->vhost->listen_accept_role);
+			lws_role_by_name(wsi->a.vhost->listen_accept_role);
 
 		if (!prot)
-			prot = wsi->vhost->listen_accept_protocol;
+			prot = wsi->a.vhost->listen_accept_protocol;
 
 		if (!role)
 			lwsl_err("%s: can't find role '%s'\n", __func__,
-				  wsi->vhost->listen_accept_role);
+				  wsi->a.vhost->listen_accept_role);
 
 		if (role && role->adoption_bind) {
 			n = role->adoption_bind(wsi, type, prot);
@@ -177,7 +177,7 @@ lws_role_call_adoption_bind(struct lws *wsi, int type, const char *prot)
 
 		lwsl_warn("%s: adoption bind to role '%s', "
 			  "protocol '%s', type 0x%x, failed\n", __func__,
-			  wsi->vhost->listen_accept_role, prot, type);
+			  wsi->a.vhost->listen_accept_role, prot, type);
 	}
 
 	/*
@@ -313,16 +313,17 @@ int
 lws_protocol_init_vhost(struct lws_vhost *vh, int *any)
 {
 	const struct lws_protocol_vhost_options *pvo, *pvo1;
-	struct lws *wsi = vh->context->pt[0].fake_wsi;
+	lws_fakewsi_def_plwsa(&vh->context->pt[0]);
 	int n;
 
-	wsi->context = vh->context;
-	wsi->vhost = vh;
+	lws_fakewsi_prep_plwsa_ctx(vh->context);
+
+	plwsa->vhost = vh;
 
 	/* initialize supported protocols on this vhost */
 
 	for (n = 0; n < vh->count_protocols; n++) {
-		wsi->protocol = &vh->protocols[n];
+		plwsa->protocol = &vh->protocols[n];
 		if (!vh->protocols[n].name)
 			continue;
 		pvo = lws_vhost_protocol_options(vh, vh->protocols[n].name);
@@ -372,10 +373,10 @@ lws_protocol_init_vhost(struct lws_vhost *vh, int *any)
 		 * inform all the protocols that they are doing their
 		 * one-time initialization if they want to.
 		 *
-		 * NOTE the wsi is all zeros except for the context, vh
-		 * + protocol ptrs so lws_get_context(wsi) etc can work
+		 * NOTE the fakewsi is garbage, except the key pointers that are
+		 * prepared in case the protocol handler wants to touch them
 		 */
-		if (vh->protocols[n].callback(wsi,
+		if (vh->protocols[n].callback((struct lws *)plwsa,
 				LWS_CALLBACK_PROTOCOL_INIT, NULL,
 				(void *)pvo, 0)) {
 			if (vh->protocol_vh_privs[n]) {
@@ -929,11 +930,11 @@ lws_create_event_pipes(struct lws_context *context)
 			lwsl_err("%s: Out of mem\n", __func__);
 			return 1;
 		}
-		wsi->context = context;
+		wsi->a.context = context;
 		lws_role_transition(wsi, 0, LRS_UNCONNECTED, &role_ops_pipe);
-		wsi->protocol = NULL;
+		wsi->a.protocol = NULL;
 		wsi->tsi = n;
-		wsi->vhost = NULL;
+		wsi->a.vhost = NULL;
 		wsi->event_pipe = 1;
 		wsi->desc.sockfd = LWS_SOCK_INVALID;
 		context->pt[n].pipe_wsi = wsi;
@@ -972,17 +973,17 @@ lws_destroy_event_pipe(struct lws *wsi)
 	if (lws_socket_is_valid(wsi->desc.sockfd))
 		__remove_wsi_socket_from_fds(wsi);
 
-	if (!wsi->context->event_loop_ops->destroy_wsi &&
-	    wsi->context->event_loop_ops->wsi_logical_close) {
-		wsi->context->event_loop_ops->wsi_logical_close(wsi);
+	if (!wsi->a.context->event_loop_ops->destroy_wsi &&
+	    wsi->a.context->event_loop_ops->wsi_logical_close) {
+		wsi->a.context->event_loop_ops->wsi_logical_close(wsi);
 		lws_plat_pipe_close(wsi);
 		return;
 	}
 
-	if (wsi->context->event_loop_ops->destroy_wsi)
-		wsi->context->event_loop_ops->destroy_wsi(wsi);
+	if (wsi->a.context->event_loop_ops->destroy_wsi)
+		wsi->a.context->event_loop_ops->destroy_wsi(wsi);
 	lws_plat_pipe_close(wsi);
-	wsi->context->count_wsi_allocated--;
+	wsi->a.context->count_wsi_allocated--;
 	lws_free(wsi);
 }
 
@@ -1113,13 +1114,13 @@ __lws_vhost_destroy2(struct lws_vhost *vh)
 	 */
 
 	memset(&wsi, 0, sizeof(wsi));
-	wsi.context = vh->context;
-	wsi.vhost = vh; /* not a real bound wsi */
+	wsi.a.context = vh->context;
+	wsi.a.vhost = vh; /* not a real bound wsi */
 	protocol = vh->protocols;
 	if (protocol && vh->created_vhost_protocols) {
 		n = 0;
 		while (n < vh->count_protocols) {
-			wsi.protocol = protocol;
+			wsi.a.protocol = protocol;
 
 			if (protocol->callback)
 				protocol->callback(&wsi, LWS_CALLBACK_PROTOCOL_DESTROY,
@@ -1292,7 +1293,7 @@ lws_check_deferred_free(struct lws_context *context, int tsi, int force)
 				struct lws *wsi = wsi_from_fd(context, pt->fds[n].fd);
 				if (!wsi)
 					continue;
-				if (wsi->vhost != v)
+				if (wsi->a.vhost != v)
 					continue;
 
 				__lws_close_free_wsi(wsi,
@@ -1389,7 +1390,7 @@ lws_context_deprecate(struct lws_context *context, lws_reload_func cb)
 		if (wsi) {
 			wsi->socket_is_permanently_unusable = 1;
 			lws_close_free_wsi(wsi, LWS_CLOSE_STATUS_NOSTATUS, "ctx deprecate");
-			wsi->context->deprecation_pending_listen_close_count++;
+			wsi->a.context->deprecation_pending_listen_close_count++;
 			/*
 			 * other vhosts can share the listen port, they
 			 * point to the same wsi.  So zap those too.
@@ -1463,10 +1464,10 @@ lws_vhost_active_conns(struct lws *wsi, struct lws **nwsi, const char *adsin)
 	}
 #endif
 
-	lws_vhost_lock(wsi->vhost); /* ----------------------------------- { */
+	lws_vhost_lock(wsi->a.vhost); /* ----------------------------------- { */
 
 	lws_start_foreach_dll_safe(struct lws_dll2 *, d, d1,
-				   wsi->vhost->dll_cli_active_conns_owner.head) {
+				   wsi->a.vhost->dll_cli_active_conns_owner.head) {
 		struct lws *w = lws_container_of(d, struct lws,
 						 dll_cli_active_conns);
 
@@ -1522,7 +1523,7 @@ lws_vhost_active_conns(struct lws *wsi, struct lws **nwsi, const char *adsin)
 
 				wsi->client_h2_alpn = 1;
 				lws_wsi_h2_adopt(w, wsi);
-				lws_vhost_unlock(wsi->vhost); /* } ---------- */
+				lws_vhost_unlock(wsi->a.vhost); /* } ---------- */
 
 				*nwsi = w;
 
@@ -1544,7 +1545,7 @@ lws_vhost_active_conns(struct lws *wsi, struct lws **nwsi, const char *adsin)
 					lws_dll2_remove(&wsi->dll2_cli_txn_queue);
 					wsi->client_mux_substream = 1;
 
-					lws_vhost_unlock(wsi->vhost); /* } ---------- */
+					lws_vhost_unlock(wsi->a.vhost); /* } ---------- */
 
 
 					return ACTIVE_CONNS_MUXED;
@@ -1577,7 +1578,7 @@ lws_vhost_active_conns(struct lws *wsi, struct lws **nwsi, const char *adsin)
 			 * and wait for our turn at client transaction_complete
 			 * to take over parsing the rx.
 			 */
-			lws_vhost_unlock(wsi->vhost); /* } ---------- */
+			lws_vhost_unlock(wsi->a.vhost); /* } ---------- */
 
 			*nwsi = w;
 
@@ -1587,7 +1588,7 @@ lws_vhost_active_conns(struct lws *wsi, struct lws **nwsi, const char *adsin)
 	} lws_end_foreach_dll_safe(d, d1);
 
 solo:
-	lws_vhost_unlock(wsi->vhost); /* } ---------------------------------- */
+	lws_vhost_unlock(wsi->a.vhost); /* } ---------------------------------- */
 
 	/* there is nobody already connected in the same way */
 
diff --git a/lib/core-net/wsi-timeout.c b/lib/core-net/wsi-timeout.c
index 7fd294493..f3610a5b2 100644
--- a/lib/core-net/wsi-timeout.c
+++ b/lib/core-net/wsi-timeout.c
@@ -27,7 +27,7 @@
 void
 __lws_wsi_remove_from_sul(struct lws *wsi)
 {
-	//struct lws_context_per_thread *pt = &wsi->context->pt[(int)wsi->tsi];
+	//struct lws_context_per_thread *pt = &wsi->a.context->pt[(int)wsi->tsi];
 
 	//lwsl_notice("%s: wsi %p, to %p, hr %p\n", __func__, wsi,
 	//		&wsi->sul_timeout.list, &wsi->sul_hrtimer.list);
@@ -48,8 +48,8 @@ lws_sul_hrtimer_cb(lws_sorted_usec_list_t *sul)
 {
 	struct lws *wsi = lws_container_of(sul, struct lws, sul_hrtimer);
 
-	if (wsi->protocol &&
-	    wsi->protocol->callback(wsi, LWS_CALLBACK_TIMER,
+	if (wsi->a.protocol &&
+	    wsi->a.protocol->callback(wsi, LWS_CALLBACK_TIMER,
 				    wsi->user_space, NULL, 0))
 		__lws_close_free_wsi(wsi, LWS_CLOSE_STATUS_NOSTATUS,
 				     "hrtimer cb errored");
@@ -58,7 +58,7 @@ lws_sul_hrtimer_cb(lws_sorted_usec_list_t *sul)
 void
 __lws_set_timer_usecs(struct lws *wsi, lws_usec_t us)
 {
-	struct lws_context_per_thread *pt = &wsi->context->pt[(int)wsi->tsi];
+	struct lws_context_per_thread *pt = &wsi->a.context->pt[(int)wsi->tsi];
 
 	wsi->sul_hrtimer.cb = lws_sul_hrtimer_cb;
 	__lws_sul_insert_us(&pt->pt_sul_owner[LWSSULLI_MISS_IF_SUSPENDED],
@@ -79,7 +79,7 @@ static void
 lws_sul_wsitimeout_cb(lws_sorted_usec_list_t *sul)
 {
 	struct lws *wsi = lws_container_of(sul, struct lws, sul_timeout);
-	struct lws_context_per_thread *pt = &wsi->context->pt[(int)wsi->tsi];
+	struct lws_context_per_thread *pt = &wsi->a.context->pt[(int)wsi->tsi];
 
 	if (wsi->pending_timeout != PENDING_TIMEOUT_USER_OK)
 		lws_stats_bump(pt, LWSSTATS_C_TIMEOUTS, 1);
@@ -124,7 +124,7 @@ lws_sul_wsitimeout_cb(lws_sorted_usec_list_t *sul)
 void
 __lws_set_timeout(struct lws *wsi, enum pending_timeout reason, int secs)
 {
-	struct lws_context_per_thread *pt = &wsi->context->pt[(int)wsi->tsi];
+	struct lws_context_per_thread *pt = &wsi->a.context->pt[(int)wsi->tsi];
 
 	wsi->sul_timeout.cb = lws_sul_wsitimeout_cb;
 	__lws_sul_insert_us(&pt->pt_sul_owner[LWSSULLI_MISS_IF_SUSPENDED],
@@ -139,7 +139,7 @@ __lws_set_timeout(struct lws *wsi, enum pending_timeout reason, int secs)
 void
 lws_set_timeout(struct lws *wsi, enum pending_timeout reason, int secs)
 {
-	struct lws_context_per_thread *pt = &wsi->context->pt[(int)wsi->tsi];
+	struct lws_context_per_thread *pt = &wsi->a.context->pt[(int)wsi->tsi];
 
 	lws_pt_lock(pt, __func__);
 	lws_dll2_remove(&wsi->sul_timeout.list);
@@ -170,7 +170,7 @@ lws_set_timeout(struct lws *wsi, enum pending_timeout reason, int secs)
 void
 lws_set_timeout_us(struct lws *wsi, enum pending_timeout reason, lws_usec_t us)
 {
-	struct lws_context_per_thread *pt = &wsi->context->pt[(int)wsi->tsi];
+	struct lws_context_per_thread *pt = &wsi->a.context->pt[(int)wsi->tsi];
 
 	lws_pt_lock(pt, __func__);
 	lws_dll2_remove(&wsi->sul_timeout.list);
@@ -216,18 +216,16 @@ lws_sul_timed_callback_vh_protocol_cb(lws_sorted_usec_list_t *sul)
 {
 	struct lws_timed_vh_protocol *tvp = lws_container_of(sul,
 					struct lws_timed_vh_protocol, sul);
-	struct lws_context_per_thread *pt =
-				&tvp->vhost->context->pt[tvp->tsi_req];
+	lws_fakewsi_def_plwsa(&tvp->vhost->context->pt[0]);
 
-	pt->fake_wsi->context = tvp->vhost->context;
-
-	pt->fake_wsi->vhost = tvp->vhost; /* not a real bound wsi */
-	pt->fake_wsi->protocol = tvp->protocol;
+	lws_fakewsi_prep_plwsa_ctx(tvp->vhost->context);
+	plwsa->vhost = tvp->vhost; /* not a real bound wsi */
+	plwsa->protocol = tvp->protocol;
 
 	lwsl_debug("%s: timed cb: vh %s, protocol %s, reason %d\n", __func__,
 		   tvp->vhost->name, tvp->protocol->name, tvp->reason);
 
-	tvp->protocol->callback(pt->fake_wsi, tvp->reason, NULL, NULL, 0);
+	tvp->protocol->callback((struct lws *)plwsa, tvp->reason, NULL, NULL, 0);
 
 	__lws_timed_callback_remove(tvp->vhost, tvp);
 }
@@ -287,7 +285,7 @@ static void
 lws_validity_cb(lws_sorted_usec_list_t *sul)
 {
 	struct lws *wsi = lws_container_of(sul, struct lws, sul_validity);
-	struct lws_context_per_thread *pt = &wsi->context->pt[(int)wsi->tsi];
+	struct lws_context_per_thread *pt = &wsi->a.context->pt[(int)wsi->tsi];
 	const lws_retry_bo_t *rbo = wsi->retry_policy;
 
 	/* one of either the ping or hangup validity threshold was crossed */
@@ -329,7 +327,7 @@ lws_validity_cb(lws_sorted_usec_list_t *sul)
 void
 _lws_validity_confirmed_role(struct lws *wsi)
 {
-	struct lws_context_per_thread *pt = &wsi->context->pt[(int)wsi->tsi];
+	struct lws_context_per_thread *pt = &wsi->a.context->pt[(int)wsi->tsi];
 	const lws_retry_bo_t *rbo = wsi->retry_policy;
 
 	if (!rbo || !rbo->secs_since_valid_hangup)
diff --git a/lib/core-net/wsi.c b/lib/core-net/wsi.c
index 67ccd7df9..a090cbd6c 100644
--- a/lib/core-net/wsi.c
+++ b/lib/core-net/wsi.c
@@ -46,34 +46,34 @@ void lwsi_set_state(struct lws *wsi, lws_wsi_state_t lrs)
 void
 lws_vhost_bind_wsi(struct lws_vhost *vh, struct lws *wsi)
 {
-	if (wsi->vhost == vh)
+	if (wsi->a.vhost == vh)
 		return;
 	lws_context_lock(vh->context, __func__); /* ---------- context { */
-	wsi->vhost = vh;
+	wsi->a.vhost = vh;
 	vh->count_bound_wsi++;
 	lws_context_unlock(vh->context); /* } context ---------- */
 	lwsl_debug("%s: vh %s: wsi %s/%s, count_bound_wsi %d\n", __func__,
 		   vh->name, wsi->role_ops ? wsi->role_ops->name : "none",
-		   wsi->protocol ? wsi->protocol->name : "none",
+		   wsi->a.protocol ? wsi->a.protocol->name : "none",
 		   vh->count_bound_wsi);
-	assert(wsi->vhost->count_bound_wsi > 0);
+	assert(wsi->a.vhost->count_bound_wsi > 0);
 }
 
 void
 lws_vhost_unbind_wsi(struct lws *wsi)
 {
-	if (!wsi->vhost)
+	if (!wsi->a.vhost)
 		return;
 
-	lws_context_lock(wsi->context, __func__); /* ---------- context { */
+	lws_context_lock(wsi->a.context, __func__); /* ---------- context { */
 
-	assert(wsi->vhost->count_bound_wsi > 0);
-	wsi->vhost->count_bound_wsi--;
+	assert(wsi->a.vhost->count_bound_wsi > 0);
+	wsi->a.vhost->count_bound_wsi--;
 	lwsl_debug("%s: vh %s: count_bound_wsi %d\n", __func__,
-		   wsi->vhost->name, wsi->vhost->count_bound_wsi);
+		   wsi->a.vhost->name, wsi->a.vhost->count_bound_wsi);
 
-	if (!wsi->vhost->count_bound_wsi &&
-	    wsi->vhost->being_destroyed) {
+	if (!wsi->a.vhost->count_bound_wsi &&
+	    wsi->a.vhost->being_destroyed) {
 		/*
 		 * We have closed all wsi that were bound to this vhost
 		 * by any pt: nothing can be servicing any wsi belonging
@@ -81,11 +81,11 @@ lws_vhost_unbind_wsi(struct lws *wsi)
 		 *
 		 * Finalize the vh destruction
 		 */
-		__lws_vhost_destroy2(wsi->vhost);
+		__lws_vhost_destroy2(wsi->a.vhost);
 	}
-	wsi->vhost = NULL;
+	wsi->a.vhost = NULL;
 
-	lws_context_unlock(wsi->context); /* } context ---------- */
+	lws_context_unlock(wsi->a.context); /* } context ---------- */
 }
 
 struct lws *
@@ -135,7 +135,7 @@ lws_callback_all_protocol(struct lws_context *context,
 			wsi = wsi_from_fd(context, pt->fds[n].fd);
 			if (!wsi)
 				continue;
-			if (wsi->protocol == protocol)
+			if (wsi->a.protocol == protocol)
 				protocol->callback(wsi, reason, wsi->user_space,
 						   NULL, 0);
 		}
@@ -160,9 +160,9 @@ lws_callback_all_protocol_vhost_args(struct lws_vhost *vh,
 			wsi = wsi_from_fd(context, pt->fds[n].fd);
 			if (!wsi)
 				continue;
-			if (wsi->vhost == vh && (wsi->protocol == protocol ||
+			if (wsi->a.vhost == vh && (wsi->a.protocol == protocol ||
 						 !protocol))
-				wsi->protocol->callback(wsi, reason,
+				wsi->a.protocol->callback(wsi, reason,
 						wsi->user_space, argp, len);
 		}
 		pt++;
@@ -183,8 +183,8 @@ lws_callback_vhost_protocols(struct lws *wsi, int reason, void *in, int len)
 {
 	int n;
 
-	for (n = 0; n < wsi->vhost->count_protocols; n++)
-		if (wsi->vhost->protocols[n].callback(wsi, reason, NULL, in, len))
+	for (n = 0; n < wsi->a.vhost->count_protocols; n++)
+		if (wsi->a.vhost->protocols[n].callback(wsi, reason, NULL, in, len))
 			return 1;
 
 	return 0;
@@ -200,12 +200,12 @@ lws_callback_vhost_protocols_vhost(struct lws_vhost *vh, int reason, void *in,
 	if (!wsi)
 		return 1;
 
-	wsi->context = vh->context;
+	wsi->a.context = vh->context;
 	lws_vhost_bind_wsi(vh, wsi);
 
-	for (n = 0; n < wsi->vhost->count_protocols; n++) {
-		wsi->protocol = &vh->protocols[n];
-		if (wsi->protocol->callback(wsi, reason, NULL, in, len)) {
+	for (n = 0; n < wsi->a.vhost->count_protocols; n++) {
+		wsi->a.protocol = &vh->protocols[n];
+		if (wsi->a.protocol->callback(wsi, reason, NULL, in, len)) {
 			lws_free(wsi);
 			return 1;
 		}
@@ -220,7 +220,7 @@ lws_callback_vhost_protocols_vhost(struct lws_vhost *vh, int reason, void *in,
 int
 lws_rx_flow_control(struct lws *wsi, int _enable)
 {
-	struct lws_context_per_thread *pt = &wsi->context->pt[(int)wsi->tsi];
+	struct lws_context_per_thread *pt = &wsi->a.context->pt[(int)wsi->tsi];
 	int en = _enable;
 
 	// h2 ignores rx flow control atm
@@ -285,7 +285,7 @@ lws_rx_flow_allow_all_protocol(const struct lws_context *context,
 			wsi = wsi_from_fd(context, pt->fds[n].fd);
 			if (!wsi)
 				continue;
-			if (wsi->protocol == protocol)
+			if (wsi->a.protocol == protocol)
 				lws_rx_flow_control(wsi, LWS_RXFLOW_ALLOW);
 		}
 		pt++;
@@ -364,28 +364,28 @@ __lws_rx_flow_control(struct lws *wsi)
 const struct lws_protocols *
 lws_get_protocol(struct lws *wsi)
 {
-	return wsi->protocol;
+	return wsi->a.protocol;
 }
 
 
 int
 lws_ensure_user_space(struct lws *wsi)
 {
-	if (!wsi->protocol)
+	if (!wsi->a.protocol)
 		return 0;
 
 	/* allocate the per-connection user memory (if any) */
 
-	if (wsi->protocol->per_session_data_size && !wsi->user_space) {
+	if (wsi->a.protocol->per_session_data_size && !wsi->user_space) {
 		wsi->user_space = lws_zalloc(
-			    wsi->protocol->per_session_data_size, "user space");
+			    wsi->a.protocol->per_session_data_size, "user space");
 		if (wsi->user_space == NULL) {
 			lwsl_err("%s: OOM\n", __func__);
 			return 1;
 		}
 	} else
 		lwsl_debug("%s: %p protocol pss %lu, user_space=%p\n", __func__,
-			   wsi, (long)wsi->protocol->per_session_data_size,
+			   wsi, (long)wsi->a.protocol->per_session_data_size,
 			   wsi->user_space);
 	return 0;
 }
@@ -607,21 +607,25 @@ int
 lws_broadcast(struct lws_context_per_thread *pt, int reason, void *in, size_t len)
 {
 	struct lws_vhost *v = pt->context->vhost_list;
+	lws_fakewsi_def_plwsa(pt);
 	int n, ret = 0;
 
-	pt->fake_wsi->context = pt->context;
+
+	lws_fakewsi_prep_plwsa_ctx(pt->context);
 
 	while (v) {
 		const struct lws_protocols *p = v->protocols;
-		pt->fake_wsi->vhost = v; /* not a real bound wsi */
+
+		plwsa->vhost = v; /* not a real bound wsi */
 
 		for (n = 0; n < v->count_protocols; n++) {
-			pt->fake_wsi->protocol = p;
+			plwsa->protocol = p;
 			if (p->callback &&
-			    p->callback(pt->fake_wsi, reason, NULL, in, len))
+			    p->callback((struct lws *)plwsa, reason, NULL, in, len))
 				ret |= 1;
 			p++;
 		}
+
 		v = v->vhost_next;
 	}
 
@@ -671,13 +675,13 @@ lws_set_opaque_parent_data(struct lws *wsi, void *data)
 void *
 lws_get_opaque_user_data(const struct lws *wsi)
 {
-	return wsi->opaque_user_data;
+	return wsi->a.opaque_user_data;
 }
 
 void
 lws_set_opaque_user_data(struct lws *wsi, void *data)
 {
-	wsi->opaque_user_data = data;
+	wsi->a.opaque_user_data = data;
 }
 
 int
@@ -730,19 +734,19 @@ lws_get_socket_fd(struct lws *wsi)
 struct lws_vhost *
 lws_vhost_get(struct lws *wsi)
 {
-	return wsi->vhost;
+	return wsi->a.vhost;
 }
 
 struct lws_vhost *
 lws_get_vhost(struct lws *wsi)
 {
-	return wsi->vhost;
+	return wsi->a.vhost;
 }
 
 const struct lws_protocols *
 lws_protocol_get(struct lws *wsi)
 {
-	return wsi->protocol;
+	return wsi->a.protocol;
 }
 
 #if defined(LWS_WITH_UDP)
@@ -756,7 +760,7 @@ lws_get_udp(const struct lws *wsi)
 struct lws_context *
 lws_get_context(const struct lws *wsi)
 {
-	return wsi->context;
+	return wsi->a.context;
 }
 
 #if defined(LWS_WITH_CLIENT)
@@ -810,7 +814,7 @@ _lws_generic_transaction_completed_active_conn(struct lws **_wsi, char take_vh_l
 	 */
 
 	if (take_vh_lock)
-		lws_vhost_lock(wsi->vhost);
+		lws_vhost_lock(wsi->a.vhost);
 
 	wnew = lws_container_of(wsi->dll2_cli_txn_queue_owner.head, struct lws,
 				dll2_cli_txn_queue);
@@ -833,8 +837,8 @@ _lws_generic_transaction_completed_active_conn(struct lws **_wsi, char take_vh_l
 	if (__remove_wsi_socket_from_fds(wsi))
 		return -1;
 
-	sanity_assert_no_wsi_traces(wsi->context, wsi);
-	sanity_assert_no_sockfd_traces(wsi->context, wsi->desc.sockfd);
+	sanity_assert_no_wsi_traces(wsi->a.context, wsi);
+	sanity_assert_no_sockfd_traces(wsi->a.context, wsi->desc.sockfd);
 	wsi->desc.sockfd = LWS_SOCK_INVALID;
 
 	__lws_wsi_remove_from_sul(wsi);
@@ -848,17 +852,17 @@ _lws_generic_transaction_completed_active_conn(struct lws **_wsi, char take_vh_l
 
 #if defined(LWS_WITH_LIBEV) || defined(LWS_WITH_LIBUV) || \
     defined(LWS_WITH_LIBEVENT) || defined(LWS_WITH_GLIB)
-	if (wsi->context->event_loop_ops->destroy_wsi)
-		wsi->context->event_loop_ops->destroy_wsi(wsi);
-	if (wsi->context->event_loop_ops->sock_accept)
-		wsi->context->event_loop_ops->sock_accept(wnew);
+	if (wsi->a.context->event_loop_ops->destroy_wsi)
+		wsi->a.context->event_loop_ops->destroy_wsi(wsi);
+	if (wsi->a.context->event_loop_ops->sock_accept)
+		wsi->a.context->event_loop_ops->sock_accept(wnew);
 #endif
 
 	/* point the fd table entry to new guy */
 
 	assert(lws_socket_is_valid(wnew->desc.sockfd));
 
-	if (__insert_wsi_socket_into_fds(wsi->context, wnew))
+	if (__insert_wsi_socket_into_fds(wsi->a.context, wnew))
 		return -1;
 
 #if defined(LWS_WITH_TLS)
@@ -883,7 +887,7 @@ _lws_generic_transaction_completed_active_conn(struct lws **_wsi, char take_vh_l
 
 	lws_dll2_remove(&wsi->dll_cli_active_conns);
 	lws_dll2_add_tail(&wnew->dll_cli_active_conns,
-			  &wsi->vhost->dll_cli_active_conns_owner);
+			  &wsi->a.vhost->dll_cli_active_conns_owner);
 
 	/* move any queued guys to queue on new active conn */
 
@@ -899,7 +903,7 @@ _lws_generic_transaction_completed_active_conn(struct lws **_wsi, char take_vh_l
 	} lws_end_foreach_dll_safe(d, d1);
 
 	if (take_vh_lock)
-		lws_vhost_unlock(wsi->vhost);
+		lws_vhost_unlock(wsi->a.vhost);
 
 	/*
 	 * The original leader who passed on all his powers already can die...
@@ -948,12 +952,12 @@ int
 lws_bind_protocol(struct lws *wsi, const struct lws_protocols *p,
 		  const char *reason)
 {
-//	if (wsi->protocol == p)
+//	if (wsi->a.protocol == p)
 //		return 0;
-	const struct lws_protocols *vp = wsi->vhost->protocols, *vpo;
+	const struct lws_protocols *vp = wsi->a.vhost->protocols, *vpo;
 
-	if (wsi->protocol && wsi->protocol_bind_balance) {
-		wsi->protocol->callback(wsi,
+	if (wsi->a.protocol && wsi->protocol_bind_balance) {
+		wsi->a.protocol->callback(wsi,
 		       wsi->role_ops->protocol_unbind_cb[!!lwsi_role_server(wsi)],
 					wsi->user_space, (void *)reason, 0);
 		wsi->protocol_bind_balance = 0;
@@ -963,17 +967,17 @@ lws_bind_protocol(struct lws *wsi, const struct lws_protocols *p,
 
 	lws_same_vh_protocol_remove(wsi);
 
-	wsi->protocol = p;
+	wsi->a.protocol = p;
 	if (!p)
 		return 0;
 
 	if (lws_ensure_user_space(wsi))
 		return 1;
 
-	if (p > vp && p < &vp[wsi->vhost->count_protocols])
+	if (p > vp && p < &vp[wsi->a.vhost->count_protocols])
 		lws_same_vh_protocol_insert(wsi, (int)(p - vp));
 	else {
-		int n = wsi->vhost->count_protocols;
+		int n = wsi->a.vhost->count_protocols;
 		int hit = 0;
 
 		vpo = vp;
@@ -988,10 +992,10 @@ lws_bind_protocol(struct lws *wsi, const struct lws_protocols *p,
 		}
 		if (!hit)
 			lwsl_err("%s: %p is not in vhost '%s' protocols list\n",
-				 __func__, p, wsi->vhost->name);
+				 __func__, p, wsi->a.vhost->name);
 	}
 
-	if (wsi->protocol->callback(wsi, wsi->role_ops->protocol_bind_cb[
+	if (wsi->a.protocol->callback(wsi, wsi->role_ops->protocol_bind_cb[
 				    !!lwsi_role_server(wsi)],
 				    wsi->user_space, NULL, 0))
 		return 1;
@@ -1023,8 +1027,8 @@ lws_http_close_immortal(struct lws *wsi)
 		 * need to reapply a normal timeout regime to the nwsi
 		 */
 		lws_set_timeout(nwsi, PENDING_TIMEOUT_HTTP_KEEPALIVE_IDLE,
-				wsi->vhost->keepalive_timeout ?
-				    wsi->vhost->keepalive_timeout : 31);
+				wsi->a.vhost->keepalive_timeout ?
+				    wsi->a.vhost->keepalive_timeout : 31);
 }
 
 void
@@ -1200,7 +1204,7 @@ lws_wsi_mux_dump_waiting_children(struct lws *wsi)
 			  wsi->mux.requested_POLLOUT ? '*' : ' ',
 			  wsi, wsi->mux.my_sid, lwsi_state(wsi),
 			  wsi->role_ops->name,
-			  wsi->protocol ? wsi->protocol->name : "noprotocol");
+			  wsi->a.protocol ? wsi->a.protocol->name : "noprotocol");
 
 		wsi = wsi->mux.sibling_list;
 	}
@@ -1345,7 +1349,7 @@ lws_wsi_txc_report_manual_txcr_in(struct lws *wsi, int32_t bump)
 		 */
 		return 0;
 
-	return user_callback_handle_rxflow(wsi->protocol->callback,
+	return user_callback_handle_rxflow(wsi->a.protocol->callback,
 					   wsi, LWS_CALLBACK_WSI_TX_CREDIT_GET,
 					   wsi->user_space, NULL, (size_t)bump);
 }
@@ -1357,7 +1361,7 @@ lws_wsi_mux_apply_queue(struct lws *wsi)
 {
 	/* we have a transaction queue that wants to pipeline */
 
-	lws_vhost_lock(wsi->vhost);
+	lws_vhost_lock(wsi->a.vhost);
 
 	lws_start_foreach_dll_safe(struct lws_dll2 *, d, d1,
 				   wsi->dll2_cli_txn_queue_owner.head) {
@@ -1394,7 +1398,7 @@ lws_wsi_mux_apply_queue(struct lws *wsi)
 
 	} lws_end_foreach_dll_safe(d, d1);
 
-	lws_vhost_unlock(wsi->vhost);
+	lws_vhost_unlock(wsi->a.vhost);
 
 	return 0;
 }
diff --git a/lib/core/context.c b/lib/core/context.c
index 1f2a73e3f..ca3593e06 100644
--- a/lib/core/context.c
+++ b/lib/core/context.c
@@ -352,7 +352,10 @@ lws_create_context(const struct lws_context_creation_info *info)
 		s1 = info->pt_serv_buf_size;
 
 	/* pt fakewsi and the pt serv buf allocations ride after the context */
-	size += count_threads * (s1 + sizeof(struct lws));
+	size += count_threads * s1;
+#if !defined(LWS_PLAT_FREERTOS)
+	size += (count_threads * sizeof(struct lws));
+#endif
 #endif
 
 	context = lws_zalloc(size, "context");
@@ -704,6 +707,7 @@ lws_create_context(const struct lws_context_creation_info *info)
 		context->pt[n].context = context;
 		context->pt[n].tid = n;
 
+#if !defined(LWS_PLAT_FREERTOS)
 		/*
 		 * We overallocated for a fakewsi (can't compose it in the
 		 * pt because size isn't known at that time).  point to it
@@ -715,6 +719,7 @@ lws_create_context(const struct lws_context_creation_info *info)
 		u += sizeof(struct lws);
 
 		memset(context->pt[n].fake_wsi, 0, sizeof(struct lws));
+#endif
 
 #if defined(LWS_ROLE_H1) || defined(LWS_ROLE_H2)
 		context->pt[n].http.ah_list = NULL;
diff --git a/lib/core/libwebsockets.c b/lib/core/libwebsockets.c
index bcd3aceec..e3b7c954d 100644
--- a/lib/core/libwebsockets.c
+++ b/lib/core/libwebsockets.c
@@ -706,12 +706,14 @@ lws_finalize_startup(struct lws_context *context)
 	return 0;
 }
 
+#if !defined(LWS_PLAT_FREERTOS)
 void
 lws_get_effective_uid_gid(struct lws_context *context, int *uid, int *gid)
 {
 	*uid = context->uid;
 	*gid = context->gid;
 }
+#endif
 
 int
 lws_snprintf(char *str, size_t size, const char *format, ...)
diff --git a/lib/event-libs/glib/glib.c b/lib/event-libs/glib/glib.c
index cd2984ece..696a0de3f 100644
--- a/lib/event-libs/glib/glib.c
+++ b/lib/event-libs/glib/glib.c
@@ -129,11 +129,11 @@ lws_glib_dispatch(GSource *src, GSourceFunc x, gpointer userData)
 	lwsl_debug("%s: wsi %p: fd %d, events %d\n", __func__, sub->wsi,
 			eventfd.fd, eventfd.revents);
 
-	pt = &sub->wsi->context->pt[(int)sub->wsi->tsi];
+	pt = &sub->wsi->a.context->pt[(int)sub->wsi->tsi];
 	if (pt->is_destroyed)
 		return G_SOURCE_CONTINUE;
 
-	lws_service_fd_tsi(sub->wsi->context, &eventfd, sub->wsi->tsi);
+	lws_service_fd_tsi(sub->wsi->a.context, &eventfd, sub->wsi->tsi);
 
 	if (!lws_gs_valid(pt->glib.idle))
 		lws_glib_set_idle(pt);
@@ -255,7 +255,7 @@ elops_init_context_glib(struct lws_context *context,
 static int
 elops_accept_glib(struct lws *wsi)
 {
-	struct lws_context_per_thread *pt = &wsi->context->pt[(int)wsi->tsi];
+	struct lws_context_per_thread *pt = &wsi->a.context->pt[(int)wsi->tsi];
 	int fd;
 
 	assert(!wsi_to_subclass(wsi));
@@ -266,7 +266,7 @@ elops_accept_glib(struct lws *wsi)
 	if (!wsi_to_subclass(wsi))
 		return 1;
 
-	wsi->w_read.context = wsi->context;
+	wsi->w_read.context = wsi->a.context;
 	wsi_to_subclass(wsi)->wsi = wsi;
 
 	if (wsi->role_ops->file_handle)
@@ -279,7 +279,7 @@ elops_accept_glib(struct lws *wsi)
 	wsi->w_read.actual_events = LWS_POLLIN;
 
 	g_source_set_callback(wsi_to_gsource(wsi),
-			G_SOURCE_FUNC(lws_service_fd), wsi->context, NULL);
+			G_SOURCE_FUNC(lws_service_fd), wsi->a.context, NULL);
 
 	g_source_attach(wsi_to_gsource(wsi), pt_to_g_main_context(pt));
 
@@ -338,10 +338,10 @@ elops_init_pt_glib(struct lws_context *context, void *_loop, int tsi)
 static void
 elops_io_glib(struct lws *wsi, int flags)
 {
-	struct lws_context_per_thread *pt = &wsi->context->pt[(int)wsi->tsi];
+	struct lws_context_per_thread *pt = &wsi->a.context->pt[(int)wsi->tsi];
 	GIOCondition cond = wsi->w_read.actual_events | G_IO_ERR;
 
-	if (!pt_to_loop(pt) || wsi->context->being_destroyed || pt->is_destroyed)
+	if (!pt_to_loop(pt) || wsi->a.context->being_destroyed || pt->is_destroyed)
 		return;
 
 	if (!wsi_to_subclass(wsi))
@@ -392,7 +392,7 @@ elops_destroy_wsi_glib(struct lws *wsi)
 	if (!wsi)
 		return;
 
-	pt = &wsi->context->pt[(int)wsi->tsi];
+	pt = &wsi->a.context->pt[(int)wsi->tsi];
 	if (pt->is_destroyed)
 		return;
 
diff --git a/lib/event-libs/libev/libev.c b/lib/event-libs/libev/libev.c
index e9248c84c..586beaf78 100644
--- a/lib/event-libs/libev/libev.c
+++ b/lib/event-libs/libev/libev.c
@@ -265,8 +265,8 @@ elops_accept_ev(struct lws *wsi)
 	else
 		fd = wsi->desc.sockfd;
 
-	wsi->w_read.context = wsi->context;
-	wsi->w_write.context = wsi->context;
+	wsi->w_read.context = wsi->a.context;
+	wsi->w_write.context = wsi->a.context;
 
 	ev_io_init(&wsi->w_read.ev.watcher, lws_accept_cb, fd, EV_READ);
 	ev_io_init(&wsi->w_write.ev.watcher, lws_accept_cb, fd, EV_WRITE);
@@ -277,7 +277,7 @@ elops_accept_ev(struct lws *wsi)
 static void
 elops_io_ev(struct lws *wsi, int flags)
 {
-	struct lws_context_per_thread *pt = &wsi->context->pt[(int)wsi->tsi];
+	struct lws_context_per_thread *pt = &wsi->a.context->pt[(int)wsi->tsi];
 
 	if (!pt->ev.io_loop || pt->is_destroyed)
 		return;
@@ -350,8 +350,8 @@ elops_init_vhost_listen_wsi_ev(struct lws *wsi)
 		return 0;
 	}
 
-	wsi->w_read.context = wsi->context;
-	wsi->w_write.context = wsi->context;
+	wsi->w_read.context = wsi->a.context;
+	wsi->w_write.context = wsi->a.context;
 
 	if (wsi->role_ops->file_handle)
 		fd = wsi->desc.filefd;
@@ -369,7 +369,7 @@ elops_init_vhost_listen_wsi_ev(struct lws *wsi)
 static void
 elops_destroy_wsi_ev(struct lws *wsi)
 {
-	struct lws_context_per_thread *pt = &wsi->context->pt[(int)wsi->tsi];
+	struct lws_context_per_thread *pt = &wsi->a.context->pt[(int)wsi->tsi];
 
 	ev_io_stop(pt->ev.io_loop, &wsi->w_read.ev.watcher);
 	ev_io_stop(pt->ev.io_loop, &wsi->w_write.ev.watcher);
diff --git a/lib/event-libs/libevent/libevent.c b/lib/event-libs/libevent/libevent.c
index 7805fc108..10035bc6c 100644
--- a/lib/event-libs/libevent/libevent.c
+++ b/lib/event-libs/libevent/libevent.c
@@ -268,9 +268,9 @@ elops_accept_event(struct lws *wsi)
 static void
 elops_io_event(struct lws *wsi, int flags)
 {
-	struct lws_context_per_thread *pt = &wsi->context->pt[(int)wsi->tsi];
+	struct lws_context_per_thread *pt = &wsi->a.context->pt[(int)wsi->tsi];
 
-	if (!pt->event.io_loop || wsi->context->being_destroyed ||
+	if (!pt->event.io_loop || wsi->a.context->being_destroyed ||
 	    pt->is_destroyed)
 		return;
 
@@ -353,7 +353,7 @@ elops_destroy_wsi_event(struct lws *wsi)
 	if (!wsi)
 		return;
 
-	pt = &wsi->context->pt[(int)wsi->tsi];
+	pt = &wsi->a.context->pt[(int)wsi->tsi];
 	if (pt->is_destroyed)
 		return;
 
@@ -387,10 +387,10 @@ elops_init_vhost_listen_wsi_event(struct lws *wsi)
 		return 0;
 	}
 
-	wsi->w_read.context = wsi->context;
-	wsi->w_write.context = wsi->context;
+	wsi->w_read.context = wsi->a.context;
+	wsi->w_write.context = wsi->a.context;
 
-	pt = &wsi->context->pt[(int)wsi->tsi];
+	pt = &wsi->a.context->pt[(int)wsi->tsi];
 
 	if (wsi->role_ops->file_handle)
 		fd = wsi->desc.filefd;
diff --git a/lib/event-libs/libuv/libuv.c b/lib/event-libs/libuv/libuv.c
index 0f0f8016b..2f6526c4d 100644
--- a/lib/event-libs/libuv/libuv.c
+++ b/lib/event-libs/libuv/libuv.c
@@ -82,7 +82,7 @@ static void
 lws_io_cb(uv_poll_t *watcher, int status, int revents)
 {
 	struct lws *wsi = (struct lws *)((uv_handle_t *)watcher)->data;
-	struct lws_context *context = wsi->context;
+	struct lws_context *context = wsi->a.context;
 	struct lws_context_per_thread *pt = &context->pt[(int)wsi->tsi];
 	struct lws_pollfd eventfd;
 
@@ -614,9 +614,9 @@ elops_close_handle_manually_uv(struct lws *wsi)
 static int
 elops_accept_uv(struct lws *wsi)
 {
-	struct lws_context_per_thread *pt = &wsi->context->pt[(int)wsi->tsi];
+	struct lws_context_per_thread *pt = &wsi->a.context->pt[(int)wsi->tsi];
 
-	wsi->w_read.context = wsi->context;
+	wsi->w_read.context = wsi->a.context;
 
 	wsi->w_read.uv.pwatcher =
 		lws_malloc(sizeof(*wsi->w_read.uv.pwatcher), "uvh");
@@ -639,7 +639,7 @@ elops_accept_uv(struct lws *wsi)
 static void
 elops_io_uv(struct lws *wsi, int flags)
 {
-	struct lws_context_per_thread *pt = &wsi->context->pt[(int)wsi->tsi];
+	struct lws_context_per_thread *pt = &wsi->a.context->pt[(int)wsi->tsi];
 	struct lws_io_watcher *w = &wsi->w_read;
 	int current_events = w->actual_events & (UV_READABLE | UV_WRITABLE);
 
@@ -700,11 +700,11 @@ elops_init_vhost_listen_wsi_uv(struct lws *wsi)
 	if (wsi->w_read.context)
 		return 0;
 
-	pt = &wsi->context->pt[(int)wsi->tsi];
+	pt = &wsi->a.context->pt[(int)wsi->tsi];
 	if (!pt->uv.io_loop)
 		return 0;
 
-	wsi->w_read.context = wsi->context;
+	wsi->w_read.context = wsi->a.context;
 
 	wsi->w_read.uv.pwatcher =
 		lws_malloc(sizeof(*wsi->w_read.uv.pwatcher), "uvh");
@@ -873,7 +873,7 @@ lws_libuv_closewsi(uv_handle_t* handle)
 	 */
 
 #if defined(LWS_WITH_SERVER)
-	if (wsi->role_ops == &role_ops_listen && wsi->context->deprecated) {
+	if (wsi->role_ops == &role_ops_listen && wsi->a.context->deprecated) {
 		lspd = 1;
 		context->deprecation_pending_listen_close_count--;
 		if (!context->deprecation_pending_listen_close_count)
diff --git a/lib/plat/freertos/freertos-pipe.c b/lib/plat/freertos/freertos-pipe.c
index 6a98c56d1..7341d49c9 100644
--- a/lib/plat/freertos/freertos-pipe.c
+++ b/lib/plat/freertos/freertos-pipe.c
@@ -27,8 +27,8 @@
 int
 lws_plat_pipe_create(struct lws *wsi)
 {
-	struct lws_context_per_thread *pt = &wsi->context->pt[(int)wsi->tsi];
-	struct sockaddr_in *si = &wsi->context->frt_pipe_si;
+	struct lws_context_per_thread *pt = &wsi->a.context->pt[(int)wsi->tsi];
+	struct sockaddr_in *si = &wsi->a.context->frt_pipe_si;
 	lws_sockfd_type *fd = pt->dummy_pipe_fds;
 
 	/*
@@ -69,8 +69,8 @@ bail:
 int
 lws_plat_pipe_signal(struct lws *wsi)
 {
-	struct lws_context_per_thread *pt = &wsi->context->pt[(int)wsi->tsi];
-	struct sockaddr_in *si = &wsi->context->frt_pipe_si;
+	struct lws_context_per_thread *pt = &wsi->a.context->pt[(int)wsi->tsi];
+	struct sockaddr_in *si = &wsi->a.context->frt_pipe_si;
 	lws_sockfd_type *fd = pt->dummy_pipe_fds;
 	uint8_t u = 0;
 	int n;
@@ -95,7 +95,7 @@ lws_plat_pipe_signal(struct lws *wsi)
 void
 lws_plat_pipe_close(struct lws *wsi)
 {
-	struct lws_context_per_thread *pt = &wsi->context->pt[(int)wsi->tsi];
+	struct lws_context_per_thread *pt = &wsi->a.context->pt[(int)wsi->tsi];
 	lws_sockfd_type *fd = pt->dummy_pipe_fds;
 
 	if (fd[0] && fd[0] != -1)
diff --git a/lib/plat/freertos/freertos-service.c b/lib/plat/freertos/freertos-service.c
index b77ba8111..8c980eade 100644
--- a/lib/plat/freertos/freertos-service.c
+++ b/lib/plat/freertos/freertos-service.c
@@ -87,14 +87,13 @@ _lws_plat_service_tsi(struct lws_context *context, int timeout_ms, int tsi)
 	timeout_us = ((lws_usec_t)timeout_ms) * LWS_US_PER_MS;
 
 	if (!pt->service_tid_detected && context->vhost_list) {
-		struct lws *_lws = pt->fake_wsi;
+		lws_fakewsi_def_plwsa(pt);
 
-		if (!_lws)
-			return 1;
-		_lws->context = context;
+		lws_fakewsi_prep_plwsa_ctx(context);
 
 		pt->service_tid = context->vhost_list->protocols[0].callback(
-			_lws, LWS_CALLBACK_GET_THREAD_ID, NULL, NULL, 0);
+			(struct lws *)plwsa, LWS_CALLBACK_GET_THREAD_ID,
+			NULL, NULL, 0);
 		pt->service_tid_detected = 1;
 	}
 
diff --git a/lib/plat/unix/unix-pipe.c b/lib/plat/unix/unix-pipe.c
index 7e4e2b3c9..2513a9ba5 100644
--- a/lib/plat/unix/unix-pipe.c
+++ b/lib/plat/unix/unix-pipe.c
@@ -31,7 +31,7 @@
 int
 lws_plat_pipe_create(struct lws *wsi)
 {
-	struct lws_context_per_thread *pt = &wsi->context->pt[(int)wsi->tsi];
+	struct lws_context_per_thread *pt = &wsi->a.context->pt[(int)wsi->tsi];
 #if defined(LWS_HAVE_EVENTFD)
 	pt->dummy_pipe_fds[0] = eventfd(0, EFD_CLOEXEC|EFD_NONBLOCK);
 	pt->dummy_pipe_fds[1] = -1;
@@ -46,7 +46,7 @@ lws_plat_pipe_create(struct lws *wsi)
 int
 lws_plat_pipe_signal(struct lws *wsi)
 {
-	struct lws_context_per_thread *pt = &wsi->context->pt[(int)wsi->tsi];
+	struct lws_context_per_thread *pt = &wsi->a.context->pt[(int)wsi->tsi];
 #if defined(LWS_HAVE_EVENTFD)
 	eventfd_t value = 1;
 	return eventfd_write(pt->dummy_pipe_fds[0], value);
@@ -63,7 +63,7 @@ lws_plat_pipe_signal(struct lws *wsi)
 void
 lws_plat_pipe_close(struct lws *wsi)
 {
-	struct lws_context_per_thread *pt = &wsi->context->pt[(int)wsi->tsi];
+	struct lws_context_per_thread *pt = &wsi->a.context->pt[(int)wsi->tsi];
 
 	if (pt->dummy_pipe_fds[0] && pt->dummy_pipe_fds[0] != -1)
 		close(pt->dummy_pipe_fds[0]);
diff --git a/lib/plat/unix/unix-service.c b/lib/plat/unix/unix-service.c
index 3e1e8fc7b..f6213b7c3 100644
--- a/lib/plat/unix/unix-service.c
+++ b/lib/plat/unix/unix-service.c
@@ -97,13 +97,13 @@ _lws_plat_service_tsi(struct lws_context *context, int timeout_ms, int tsi)
 		context->event_loop_ops->run_pt(context, tsi);
 
 	if (!pt->service_tid_detected && context->vhost_list) {
-		struct lws _lws;
+		lws_fakewsi_def_plwsa(pt);
 
-		memset(&_lws, 0, sizeof(_lws));
-		_lws.context = context;
+		lws_fakewsi_prep_plwsa_ctx(context);
 
 		pt->service_tid = context->vhost_list->protocols[0].callback(
-					&_lws, LWS_CALLBACK_GET_THREAD_ID,
+					(struct lws *)plwsa,
+					LWS_CALLBACK_GET_THREAD_ID,
 					NULL, NULL, 0);
 		pt->service_tid_detected = 1;
 	}
diff --git a/lib/plat/unix/unix-spawn.c b/lib/plat/unix/unix-spawn.c
index 190af4291..56fcbfebb 100644
--- a/lib/plat/unix/unix-spawn.c
+++ b/lib/plat/unix/unix-spawn.c
@@ -84,7 +84,7 @@ lws_create_basic_wsi(struct lws_context *context, int tsi,
 	}
 
 	new_wsi->tsi = tsi;
-	new_wsi->context = context;
+	new_wsi->a.context = context;
 	new_wsi->pending_timeout = NO_PENDING_TIMEOUT;
 	new_wsi->rxflow_change_to = LWS_RXFLOW_ALLOW;
 
@@ -361,8 +361,8 @@ lws_spawn_piped(const struct lws_spawn_piped_info *i)
 		}
 		lsp->stdwsi[n]->lsp_channel = n;
 		lws_vhost_bind_wsi(i->vh, lsp->stdwsi[n]);
-		lsp->stdwsi[n]->protocol = pcol;
-		lsp->stdwsi[n]->opaque_user_data = i->opaque;
+		lsp->stdwsi[n]->a.protocol = pcol;
+		lsp->stdwsi[n]->a.opaque_user_data = i->opaque;
 
 		lwsl_debug("%s: lsp stdwsi %p: pipe idx %d -> fd %d / %d\n", __func__,
 			   lsp->stdwsi[n], n, lsp->pipe_fds[n][n == 0],
diff --git a/lib/plat/windows/windows-pipe.c b/lib/plat/windows/windows-pipe.c
index b2bb12e0c..94e67bd06 100644
--- a/lib/plat/windows/windows-pipe.c
+++ b/lib/plat/windows/windows-pipe.c
@@ -36,7 +36,7 @@ lws_plat_pipe_create(struct lws *wsi)
 int
 lws_plat_pipe_signal(struct lws *wsi)
 {
-	struct lws_context_per_thread *pt = &wsi->context->pt[(int)wsi->tsi];
+	struct lws_context_per_thread *pt = &wsi->a.context->pt[(int)wsi->tsi];
 
 	EnterCriticalSection(&pt->interrupt_lock);
 	pt->interrupt_requested = 1;
diff --git a/lib/plat/windows/windows-service.c b/lib/plat/windows/windows-service.c
index 78827411b..1b8313fb7 100644
--- a/lib/plat/windows/windows-service.c
+++ b/lib/plat/windows/windows-service.c
@@ -77,13 +77,13 @@ _lws_plat_service_tsi(struct lws_context *context, int timeout_ms, int tsi)
 	pt = &context->pt[tsi];
 
 	if (!pt->service_tid_detected && context->vhost_list) {
-		struct lws _lws;
+		lws_fakewsi_def_plwsa(pt);
 
-		memset(&_lws, 0, sizeof(_lws));
-		_lws.context = context;
+		lws_fakewsi_prep_plwsa_ctx(context);
 
 		pt->service_tid = context->vhost_list->
-			protocols[0].callback(&_lws, LWS_CALLBACK_GET_THREAD_ID,
+			protocols[0].callback((struct lws *)plwsa,
+					LWS_CALLBACK_GET_THREAD_ID,
 						  NULL, NULL, 0);
 		pt->service_tid_detected = 1;
 	}
diff --git a/lib/plat/windows/windows-spawn.c b/lib/plat/windows/windows-spawn.c
index 084691c34..a65968fad 100644
--- a/lib/plat/windows/windows-spawn.c
+++ b/lib/plat/windows/windows-spawn.c
@@ -83,7 +83,7 @@ lws_create_basic_wsi(struct lws_context *context, int tsi,
 	}
 
 	new_wsi->tsi = tsi;
-	new_wsi->context = context;
+	new_wsi->a.context = context;
 	new_wsi->pending_timeout = NO_PENDING_TIMEOUT;
 	new_wsi->rxflow_change_to = LWS_RXFLOW_ALLOW;
 
@@ -296,7 +296,7 @@ windows_pipe_poll_hack(lws_sorted_usec_list_t *sul)
 			return;
 		} else
 			if (br)
-				wsi->protocol->callback(wsi,
+				wsi->a.protocol->callback(wsi,
 							LWS_CALLBACK_RAW_RX_FILE,
 							NULL, NULL, 0);
 	}
diff --git a/lib/roles/cgi/cgi-server.c b/lib/roles/cgi/cgi-server.c
index 01eaf0d65..e0dd7fd64 100644
--- a/lib/roles/cgi/cgi-server.c
+++ b/lib/roles/cgi/cgi-server.c
@@ -101,7 +101,7 @@ lws_cgi_reap_cb(void *opaque, lws_usec_t *accounting, siginfo_t *si,
 	 * Grace period to handle the incoming stdout
 	 */
 
-	lws_sul_schedule(wsi->context, wsi->tsi, &wsi->http.cgi->sul_grace,
+	lws_sul_schedule(wsi->a.context, wsi->tsi, &wsi->http.cgi->sul_grace,
 			 lws_cgi_grace, 1 * LWS_US_PER_SEC);
 }
 
@@ -110,7 +110,7 @@ lws_cgi(struct lws *wsi, const char * const *exec_array,
 	int script_uri_path_len, int timeout_secs,
 	const struct lws_protocol_vhost_options *mp_cgienv)
 {
-	struct lws_context_per_thread *pt = &wsi->context->pt[(int)wsi->tsi];
+	struct lws_context_per_thread *pt = &wsi->a.context->pt[(int)wsi->tsi];
 	struct lws_spawn_piped_info info;
 	char *env_array[30], cgi_path[500], e[1024], *p = e,
 	     *end = p + sizeof(e) - 1, tok[256], *t, *sum, *sumend;
@@ -391,7 +391,7 @@ lws_cgi(struct lws *wsi, const char * const *exec_array,
 	info.opt_parent = wsi;
 	info.timeout_us = 5 * 60 * LWS_US_PER_SEC;
 	info.tsi = wsi->tsi;
-	info.vh = wsi->vhost;
+	info.vh = wsi->a.vhost;
 	info.ops = &role_ops_cgi;
 	info.plsp = &wsi->http.cgi->lsp;
 	info.opaque = wsi;
@@ -414,10 +414,10 @@ lws_cgi(struct lws *wsi, const char * const *exec_array,
 
 	/* we are the parent process */
 
-	wsi->context->count_cgi_spawned++;
+	wsi->a.context->count_cgi_spawned++;
 
 	/* inform cgi owner of the child PID */
-	n = user_callback_handle_rxflow(wsi->protocol->callback, wsi,
+	n = user_callback_handle_rxflow(wsi->a.protocol->callback, wsi,
 				    LWS_CALLBACK_CGI_PROCESS_ATTACH,
 				    wsi->user_space, NULL, cgi->lsp->child_pid);
 	(void)n;
@@ -914,7 +914,7 @@ lws_cgi_kill(struct lws *wsi)
 
 	if (pid != -1) {
 		m = wsi->http.cgi->being_closed;
-		n = user_callback_handle_rxflow(wsi->protocol->callback, wsi,
+		n = user_callback_handle_rxflow(wsi->a.protocol->callback, wsi,
 						LWS_CALLBACK_CGI_TERMINATED,
 						wsi->user_space, (void *)&args,
 						pid);
@@ -1073,7 +1073,7 @@ lws_cgi_get_stdwsi(struct lws *wsi, enum lws_enum_stdinouterr ch)
 void
 lws_cgi_remove_and_kill(struct lws *wsi)
 {
-	struct lws_context_per_thread *pt = &wsi->context->pt[(int)wsi->tsi];
+	struct lws_context_per_thread *pt = &wsi->a.context->pt[(int)wsi->tsi];
 	struct lws_cgi **pcgi = &pt->http.cgi_list;
 
 	/* remove us from the cgi list */
diff --git a/lib/roles/cgi/ops-cgi.c b/lib/roles/cgi/ops-cgi.c
index a67a509d2..40370e1a4 100644
--- a/lib/roles/cgi/ops-cgi.c
+++ b/lib/roles/cgi/ops-cgi.c
@@ -74,7 +74,7 @@ rops_handle_POLLIN_cgi(struct lws_context_per_thread *pt, struct lws *wsi,
 	lwsl_debug("CGI LWS_STDOUT %p wsistate 0x%x\n",
 		   wsi->parent, wsi->wsistate);
 
-	if (user_callback_handle_rxflow(wsi->parent->protocol->callback,
+	if (user_callback_handle_rxflow(wsi->parent->a.protocol->callback,
 					wsi->parent, LWS_CALLBACK_CGI,
 					wsi->parent->user_space,
 					(void *)&args, 0))
diff --git a/lib/roles/dbus/dbus.c b/lib/roles/dbus/dbus.c
index 3662c12ed..cffed03a2 100644
--- a/lib/roles/dbus/dbus.c
+++ b/lib/roles/dbus/dbus.c
@@ -76,10 +76,10 @@ __lws_shadow_wsi(struct lws_dbus_ctx *ctx, DBusWatch *w, int fd, int create_ok)
 
 	lwsl_info("%s: creating shadow wsi\n", __func__);
 
-	wsi->context = ctx->vh->context;
+	wsi->a.context = ctx->vh->context;
 	wsi->desc.sockfd = fd;
 	lws_role_transition(wsi, 0, LRS_ESTABLISHED, &role_ops_dbus);
-	wsi->protocol = ctx->vh->protocols;
+	wsi->a.protocol = ctx->vh->protocols;
 	wsi->tsi = ctx->tsi;
 	wsi->shadow = 1;
 	wsi->opaque_parent_data = ctx;
diff --git a/lib/roles/h1/ops-h1.c b/lib/roles/h1/ops-h1.c
index 254e003af..1f111900e 100644
--- a/lib/roles/h1/ops-h1.c
+++ b/lib/roles/h1/ops-h1.c
@@ -150,7 +150,7 @@ http_postbody:
 
 				/* returns how much used */
 				n = user_callback_handle_rxflow(
-					wsi->protocol->callback,
+					wsi->a.protocol->callback,
 					wsi, LWS_CALLBACK_CGI_STDIN_DATA,
 					wsi->user_space,
 					(void *)&args, 0);
@@ -159,7 +159,7 @@ http_postbody:
 			} else {
 #endif
 				if (lwsi_state(wsi) != LRS_DISCARD_BODY) {
-				n = wsi->protocol->callback(wsi,
+				n = wsi->a.protocol->callback(wsi,
 					LWS_CALLBACK_HTTP_BODY, wsi->user_space,
 					buf, (size_t)body_chunk_len);
 				if (n)
@@ -174,7 +174,7 @@ http_postbody:
 			if (wsi->http.rx_content_remain)  {
 				lws_set_timeout(wsi,
 						PENDING_TIMEOUT_HTTP_CONTENT,
-						wsi->context->timeout_secs);
+						wsi->a.context->timeout_secs);
 				break;
 			}
 			/* he sent all the content in time */
@@ -186,7 +186,7 @@ postbody_completion:
 			 */
 			if (wsi->http.cgi)
 				lws_set_timeout(wsi, PENDING_TIMEOUT_CGI,
-						wsi->context->timeout_secs);
+						wsi->a.context->timeout_secs);
 			else
 #endif
 			lws_set_timeout(wsi, NO_PENDING_TIMEOUT, 0);
@@ -208,9 +208,9 @@ postbody_completion:
 				}
 #endif
 				lwsl_info("HTTP_BODY_COMPLETION: %p (%s)\n",
-					  wsi, wsi->protocol->name);
+					  wsi, wsi->a.protocol->name);
 
-				n = wsi->protocol->callback(wsi,
+				n = wsi->a.protocol->callback(wsi,
 					LWS_CALLBACK_HTTP_BODY_COMPLETION,
 					wsi->user_space, NULL, 0);
 				if (n)
@@ -301,7 +301,7 @@ bail:
 static int
 lws_h1_server_socket_service(struct lws *wsi, struct lws_pollfd *pollfd)
 {
-	struct lws_context_per_thread *pt = &wsi->context->pt[(int)wsi->tsi];
+	struct lws_context_per_thread *pt = &wsi->a.context->pt[(int)wsi->tsi];
 	struct lws_tokens ebuf;
 	int n, buffered;
 
@@ -507,7 +507,7 @@ try_pollout:
 		}
 #endif
 
-		n = user_callback_handle_rxflow(wsi->protocol->callback, wsi,
+		n = user_callback_handle_rxflow(wsi->a.protocol->callback, wsi,
 						LWS_CALLBACK_HTTP_WRITEABLE,
 						wsi->user_space, NULL, 0);
 		if (n < 0) {
@@ -670,12 +670,12 @@ rops_handle_POLLIN_h1(struct lws_context_per_thread *pt, struct lws *wsi,
 		if (lws_change_pollfd(wsi, LWS_POLLIN, 0))
 			return LWS_HPI_RET_PLEASE_CLOSE_ME;
 
-		//lwsl_notice("calling back %s\n", wsi->protocol->name);
+		//lwsl_notice("calling back %s\n", wsi->a.protocol->name);
 
 		/* let user code know, he'll usually ask for writeable
 		 * callback and drain / re-enable it there
 		 */
-		if (user_callback_handle_rxflow(wsi->protocol->callback, wsi,
+		if (user_callback_handle_rxflow(wsi->a.protocol->callback, wsi,
 					       LWS_CALLBACK_RECEIVE_CLIENT_HTTP,
 						wsi->user_space, NULL, 0)) {
 			lwsl_info("RECEIVE_CLIENT_HTTP closed it\n");
@@ -753,7 +753,7 @@ rops_handle_POLLOUT_h1(struct lws *wsi)
 #endif
 				lwsi_set_state(wsi, LRS_WAITING_SERVER_REPLY);
 				lws_set_timeout(wsi, PENDING_TIMEOUT_AWAITING_SERVER_RESPONSE,
-						wsi->context->timeout_secs);
+						wsi->a.context->timeout_secs);
 			}
 		}
 #endif
@@ -857,7 +857,7 @@ rops_alpn_negotiated_h1(struct lws *wsi, const char *alpn)
 static int
 rops_destroy_role_h1(struct lws *wsi)
 {
-	struct lws_context_per_thread *pt = &wsi->context->pt[(int)wsi->tsi];
+	struct lws_context_per_thread *pt = &wsi->a.context->pt[(int)wsi->tsi];
 	struct allocated_headers *ah;
 
 	/* we may not have an ah, but may be on the waiting list... */
@@ -910,7 +910,7 @@ rops_adoption_bind_h1(struct lws *wsi, int type, const char *vh_prot_name)
 	/* If Non-TLS and HTTP2 prior knowledge is enabled, skip to clear text HTTP2 */
 
 #if defined(LWS_WITH_HTTP2)
-	if ((!(type & LWS_ADOPT_ALLOW_SSL)) && (wsi->vhost->options & LWS_SERVER_OPTION_H2_PRIOR_KNOWLEDGE)) {
+	if ((!(type & LWS_ADOPT_ALLOW_SSL)) && (wsi->a.vhost->options & LWS_SERVER_OPTION_H2_PRIOR_KNOWLEDGE)) {
 		lwsl_info("http/2 prior knowledge\n");
 		lws_role_call_alpn_negotiated(wsi, "h2");
 	}
@@ -925,16 +925,16 @@ rops_adoption_bind_h1(struct lws *wsi, int type, const char *vh_prot_name)
 	 * default is disabled (ws upgrade caees properly about it)
 	 */
 
-	if (!vh_prot_name && wsi->vhost->default_protocol_index <
-			     wsi->vhost->count_protocols)
-		wsi->protocol = &wsi->vhost->protocols[
-				wsi->vhost->default_protocol_index];
+	if (!vh_prot_name && wsi->a.vhost->default_protocol_index <
+			     wsi->a.vhost->count_protocols)
+		wsi->a.protocol = &wsi->a.vhost->protocols[
+				wsi->a.vhost->default_protocol_index];
 	else
-		wsi->protocol = &wsi->vhost->protocols[0];
+		wsi->a.protocol = &wsi->a.vhost->protocols[0];
 
 	/* the transport is accepted... give him time to negotiate */
 	lws_set_timeout(wsi, PENDING_TIMEOUT_ESTABLISH_WITH_SERVER,
-			wsi->context->timeout_secs);
+			wsi->a.context->timeout_secs);
 
 	return 1; /* bound */
 }
@@ -1117,7 +1117,7 @@ rops_close_kill_connection_h1(struct lws *wsi, enum lws_close_status reason)
 
 	wsi->http.proxy_clientside = 0;
 
-	if (user_callback_handle_rxflow(wsi->protocol->callback, wsi,
+	if (user_callback_handle_rxflow(wsi->a.protocol->callback, wsi,
 					LWS_CALLBACK_COMPLETED_CLIENT_HTTP,
 					wsi->user_space, NULL, 0))
 		return 0;
diff --git a/lib/roles/h2/hpack.c b/lib/roles/h2/hpack.c
index 153e8d285..8f488194d 100644
--- a/lib/roles/h2/hpack.c
+++ b/lib/roles/h2/hpack.c
@@ -283,7 +283,7 @@ static int lws_frag_append(struct lws *wsi, unsigned char c)
 	ah->data[ah->pos++] = c;
 	ah->frags[ah->nfrag].len++;
 
-	return (int)ah->pos >= wsi->context->max_http_header_data;
+	return (int)ah->pos >= wsi->a.context->max_http_header_data;
 }
 
 static int lws_frag_end(struct lws *wsi)
@@ -597,27 +597,27 @@ lws_hpack_dynamic_size(struct lws *wsi, int size)
 	dyn = &nwsi->h2.h2n->hpack_dyn_table;
 	lwsl_info("%s: from %d to %d, lim %u\n", __func__,
 		  (int)dyn->num_entries, size,
-		  (unsigned int)nwsi->vhost->h2.set.s[H2SET_HEADER_TABLE_SIZE]);
+		  (unsigned int)nwsi->a.vhost->h2.set.s[H2SET_HEADER_TABLE_SIZE]);
 
 	if (!size) {
 		size = dyn->num_entries * 8;
 		lws_hpack_destroy_dynamic_header(wsi);
 	}
 
-	if (size > (int)nwsi->vhost->h2.set.s[H2SET_HEADER_TABLE_SIZE]) {
+	if (size > (int)nwsi->a.vhost->h2.set.s[H2SET_HEADER_TABLE_SIZE]) {
 		lwsl_info("rejecting hpack dyn size %u vs %u\n", size,
-			  (unsigned int)nwsi->vhost->h2.set.s[H2SET_HEADER_TABLE_SIZE]);
+			  (unsigned int)nwsi->a.vhost->h2.set.s[H2SET_HEADER_TABLE_SIZE]);
 
 		// this seems necessary to work with some browsers
 
-		if (nwsi->vhost->h2.set.s[H2SET_HEADER_TABLE_SIZE] == 65536 &&
+		if (nwsi->a.vhost->h2.set.s[H2SET_HEADER_TABLE_SIZE] == 65536 &&
 				size == 65537) { /* h2spec */
 			lws_h2_goaway(nwsi, H2_ERR_COMPRESSION_ERROR,
 				  "Asked for header table bigger than we told");
 			goto bail;
 		}
 
-		size = nwsi->vhost->h2.set.s[H2SET_HEADER_TABLE_SIZE];
+		size = nwsi->a.vhost->h2.set.s[H2SET_HEADER_TABLE_SIZE];
 	}
 
 	dyn->virtual_payload_max = size;
diff --git a/lib/roles/h2/http2.c b/lib/roles/h2/http2.c
index 82f01225a..2975646e9 100644
--- a/lib/roles/h2/http2.c
+++ b/lib/roles/h2/http2.c
@@ -133,7 +133,7 @@ lws_h2_new_pps(enum lws_h2_protocol_send_type type)
 
 void lws_h2_init(struct lws *wsi)
 {
-	wsi->h2.h2n->our_set = wsi->vhost->h2.set;
+	wsi->h2.h2n->our_set = wsi->a.vhost->h2.set;
 	wsi->h2.h2n->peer_set = lws_h2_defaults;
 }
 
@@ -261,12 +261,12 @@ lws_wsi_server_new(struct lws_vhost *vh, struct lws *parent_wsi,
 	lwsi_set_state(wsi, LRS_ESTABLISHED);
 	lwsi_set_role(wsi, lwsi_role(parent_wsi));
 
-	wsi->protocol = &vh->protocols[0];
+	wsi->a.protocol = &vh->protocols[0];
 	if (lws_ensure_user_space(wsi))
 		goto bail1;
 
 #if defined(LWS_WITH_SERVER_STATUS)
-	wsi->vhost->conn_stats.h2_subs++;
+	wsi->a.vhost->conn_stats.h2_subs++;
 #endif
 
 	/* get the ball rolling */
@@ -344,7 +344,7 @@ lws_wsi_h2_adopt(struct lws *parent_wsi, struct lws *wsi)
 	lws_callback_on_writable(wsi);
 
 #if defined(LWS_WITH_SERVER_STATUS)
-	wsi->vhost->conn_stats.h2_subs++;
+	wsi->a.vhost->conn_stats.h2_subs++;
 #endif
 
 	return wsi;
@@ -356,7 +356,7 @@ bail1:
 
 	if (wsi->user_space)
 		lws_free_set_NULL(wsi->user_space);
-	wsi->protocol->callback(wsi, LWS_CALLBACK_WSI_DESTROY, NULL, NULL, 0);
+	wsi->a.protocol->callback(wsi, LWS_CALLBACK_WSI_DESTROY, NULL, NULL, 0);
 	lws_free(wsi);
 
 	return NULL;
@@ -540,7 +540,7 @@ lws_h2_settings(struct lws *wsi, struct http2_settings *settings,
 
 			break;
 		case H2SET_MAX_FRAME_SIZE:
-			if (b < wsi->vhost->h2.set.s[H2SET_MAX_FRAME_SIZE]) {
+			if (b < wsi->a.vhost->h2.set.s[H2SET_MAX_FRAME_SIZE]) {
 				lws_h2_goaway(nwsi, H2_ERR_PROTOCOL_ERROR,
 					      "Frame size < initial");
 				return 1;
@@ -766,7 +766,7 @@ int lws_h2_do_pps_send(struct lws *wsi)
 			if (lws_is_ssl(lws_get_network_wsi(wsi)))
 				break;
 
-			if (wsi->vhost->options &
+			if (wsi->a.vhost->options &
 				LWS_SERVER_OPTION_H2_PRIOR_KNOWLEDGE)
 				break;
 
@@ -774,7 +774,7 @@ int lws_h2_do_pps_send(struct lws *wsi)
 			 * we need to treat the headers from the upgrade as the
 			 * first job.  So these need to get shifted to sid 1.
 			 */
-			h2n->swsi = lws_wsi_server_new(wsi->vhost, wsi, 1);
+			h2n->swsi = lws_wsi_server_new(wsi->a.vhost, wsi, 1);
 			if (!h2n->swsi)
 				goto bail;
 
@@ -794,7 +794,7 @@ int lws_h2_do_pps_send(struct lws *wsi)
 			lwsl_info("servicing initial http request\n");
 
 #if defined(LWS_WITH_SERVER_STATUS)
-			wsi->vhost->conn_stats.h2_trans++;
+			wsi->a.vhost->conn_stats.h2_trans++;
 #endif
 #if defined(LWS_WITH_SERVER)
 			if (lws_http_action(h2n->swsi))
@@ -867,7 +867,7 @@ int lws_h2_do_pps_send(struct lws *wsi)
 		if (cwsi) {
 			lwsl_debug("%s: closing cwsi %p %s %s (wsi %p)\n",
 				   __func__, cwsi, cwsi->role_ops->name,
-				   cwsi->protocol->name, wsi);
+				   cwsi->a.protocol->name, wsi);
 			lws_close_free_wsi(cwsi, 0, "reset stream");
 		}
 		break;
@@ -935,8 +935,8 @@ lws_h2_parse_frame_header(struct lws *wsi)
 
 	if (!wsi->immortal_substream_count)
 		lws_set_timeout(wsi, PENDING_TIMEOUT_HTTP_KEEPALIVE_IDLE,
-				wsi->vhost->keepalive_timeout ?
-					wsi->vhost->keepalive_timeout : 31);
+				wsi->a.vhost->keepalive_timeout ?
+					wsi->a.vhost->keepalive_timeout : 31);
 
 	if (h2n->sid)
 		h2n->swsi = lws_wsi_mux_from_id(wsi, h2n->sid);
@@ -1223,7 +1223,7 @@ lws_h2_parse_frame_header(struct lws *wsi)
 			 * of a new stream
 			 */
 
-			h2n->swsi = lws_wsi_server_new(wsi->vhost, wsi,
+			h2n->swsi = lws_wsi_server_new(wsi->a.vhost, wsi,
 						       h2n->sid);
 			if (!h2n->swsi) {
 				lws_h2_goaway(wsi, H2_ERR_PROTOCOL_ERROR,
@@ -1269,7 +1269,7 @@ lws_h2_parse_frame_header(struct lws *wsi)
 			assert(w->mux.sibling_list != w);
 		} lws_end_foreach_ll(w, mux.sibling_list);
 
-		if (lws_check_opt(h2n->swsi->vhost->options,
+		if (lws_check_opt(h2n->swsi->a.vhost->options,
 			       LWS_SERVER_OPTION_VH_H2_HALF_CLOSED_LONG_POLL)) {
 
 			/*
@@ -1401,7 +1401,7 @@ lws_h2_parse_end_of_frame(struct lws *wsi)
 			 * we need to treat the headers from the upgrade as the
 			 * first job.  So these need to get shifted to sid 1.
 			 */
-			h2n->swsi = lws_wsi_server_new(wsi->vhost, wsi, 1);
+			h2n->swsi = lws_wsi_server_new(wsi->a.vhost, wsi, 1);
 			if (!h2n->swsi)
 				return 1;
 			h2n->sid = 1;
@@ -1424,15 +1424,15 @@ lws_h2_parse_end_of_frame(struct lws *wsi)
 			h2n->swsi->flags = wsi->flags;
 #endif
 
-			h2n->swsi->protocol = wsi->protocol;
+			h2n->swsi->a.protocol = wsi->a.protocol;
 			if (h2n->swsi->user_space &&
 			    !h2n->swsi->user_space_externally_allocated)
 				lws_free(h2n->swsi->user_space);
 			h2n->swsi->user_space = wsi->user_space;
 			h2n->swsi->user_space_externally_allocated =
 					wsi->user_space_externally_allocated;
-			h2n->swsi->opaque_user_data = wsi->opaque_user_data;
-			wsi->opaque_user_data = NULL;
+			h2n->swsi->a.opaque_user_data = wsi->a.opaque_user_data;
+			wsi->a.opaque_user_data = NULL;
 			h2n->swsi->txc.manual_initial_tx_credit =
 					wsi->txc.manual_initial_tx_credit;
 
@@ -1635,7 +1635,7 @@ lws_h2_parse_end_of_frame(struct lws *wsi)
 #endif
 
 #if defined(LWS_WITH_SERVER_STATUS)
-		wsi->vhost->conn_stats.h2_trans++;
+		wsi->a.vhost->conn_stats.h2_trans++;
 #endif
 		p = lws_hdr_simple_ptr(h2n->swsi, WSI_TOKEN_HTTP_COLON_METHOD);
 		/*
@@ -1753,7 +1753,7 @@ lws_h2_parse_end_of_frame(struct lws *wsi)
 			break; /* ignore */
 		}
 
-		if (eff_wsi->vhost->options &
+		if (eff_wsi->a.vhost->options &
 		        LWS_SERVER_OPTION_H2_JUST_FIX_WINDOW_UPDATE_OVERFLOW &&
 		    (uint64_t)eff_wsi->txc.tx_cr + (uint64_t)h2n->hpack_e_dep >
 		    (uint64_t)0x7fffffff)
@@ -2011,8 +2011,8 @@ lws_h2_parser(struct lws *wsi, unsigned char *in, lws_filepos_t inlen,
 				if (!wsi->immortal_substream_count)
 					lws_set_timeout(wsi,
 					PENDING_TIMEOUT_HTTP_KEEPALIVE_IDLE,
-						wsi->vhost->keepalive_timeout ?
-					    wsi->vhost->keepalive_timeout : 31);
+						wsi->a.vhost->keepalive_timeout ?
+					    wsi->a.vhost->keepalive_timeout : 31);
 
 				if (!h2n->swsi)
 					break;
@@ -2055,7 +2055,7 @@ lws_h2_parser(struct lws *wsi, unsigned char *in, lws_filepos_t inlen,
 				}
 #if defined(LWS_WITH_CLIENT)
 				if (h2n->swsi->client_mux_substream) {
-					if (!h2n->swsi->protocol) {
+					if (!h2n->swsi->a.protocol) {
 						lwsl_err("%s: swsi %p doesn't have protocol\n",
 							 __func__, h2n->swsi);
 						m = 1;
@@ -2066,7 +2066,7 @@ lws_h2_parser(struct lws *wsi, unsigned char *in, lws_filepos_t inlen,
 							__func__,
 							h2n->swsi->mux.my_sid);
 					m = user_callback_handle_rxflow(
-						h2n->swsi->protocol->callback,
+						h2n->swsi->a.protocol->callback,
 						h2n->swsi,
 					  LWS_CALLBACK_RECEIVE_CLIENT_HTTP_READ,
 						h2n->swsi->user_space,
@@ -2096,7 +2096,7 @@ lws_h2_parser(struct lws *wsi, unsigned char *in, lws_filepos_t inlen,
 					if (m) {
 						struct lws_context_per_thread *pt;
 
-						pt = &wsi->context->pt[(int)wsi->tsi];
+						pt = &wsi->a.context->pt[(int)wsi->tsi];
 						lwsl_debug("%s: added %p to rxflow list\n",
 							   __func__, wsi);
 						lws_dll2_add_head(
@@ -2320,7 +2320,7 @@ fail:
 int
 lws_h2_client_handshake(struct lws *wsi)
 {
-	struct lws_context_per_thread *pt = &wsi->context->pt[(int)wsi->tsi];
+	struct lws_context_per_thread *pt = &wsi->a.context->pt[(int)wsi->tsi];
 	uint8_t *buf, *start, *p, *p1, *end;
 	char *meth = lws_hdr_simple_ptr(wsi, _WSI_TOKEN_CLIENT_METHOD),
 	     *uri = lws_hdr_simple_ptr(wsi, _WSI_TOKEN_CLIENT_URI);
@@ -2354,7 +2354,7 @@ lws_h2_client_handshake(struct lws *wsi)
 			__func__, wsi->mux.my_sid);
 
 	p = start = buf = pt->serv_buf + LWS_PRE;
-	end = start + (wsi->context->pt_serv_buf_size / 2) - LWS_PRE - 1;
+	end = start + (wsi->a.context->pt_serv_buf_size / 2) - LWS_PRE - 1;
 
 	/* it's time for us to send our client stream headers */
 
@@ -2418,7 +2418,7 @@ lws_h2_client_handshake(struct lws *wsi)
 
 	/* give userland a chance to append, eg, cookies */
 
-	if (wsi->protocol->callback(wsi,
+	if (wsi->a.protocol->callback(wsi,
 				LWS_CALLBACK_CLIENT_APPEND_HANDSHAKE_HEADER,
 				wsi->user_space, &p, (end - p) - 12))
 		goto fail_length;
@@ -2511,10 +2511,10 @@ lws_h2_ws_handshake(struct lws *wsi)
 		 *  - one came in, and ... */
 		if (lws_hdr_total_length(wsi, WSI_TOKEN_PROTOCOL) &&
 		    /*  - it is not an empty string */
-		    wsi->protocol->name && wsi->protocol->name[0]) {
+		    wsi->a.protocol->name && wsi->a.protocol->name[0]) {
 			if (lws_add_http_header_by_token(wsi, WSI_TOKEN_PROTOCOL,
-				(unsigned char *)wsi->protocol->name,
-				(int)strlen(wsi->protocol->name), &p, end))
+				(unsigned char *)wsi->a.protocol->name,
+				(int)strlen(wsi->a.protocol->name), &p, end))
 			return -1;
 		}
 	}
@@ -2544,7 +2544,7 @@ lws_h2_ws_handshake(struct lws *wsi)
 	hit = lws_find_mount(wsi, uri_ptr, n);
 
 	if (hit && hit->cgienv &&
-	    wsi->protocol->callback(wsi, LWS_CALLBACK_HTTP_PMO, wsi->user_space,
+	    wsi->a.protocol->callback(wsi, LWS_CALLBACK_HTTP_PMO, wsi->user_space,
 				    (void *)hit->cgienv, 0))
 		return 1;
 
diff --git a/lib/roles/h2/ops-h2.c b/lib/roles/h2/ops-h2.c
index f7744fdef..74f5a1aba 100644
--- a/lib/roles/h2/ops-h2.c
+++ b/lib/roles/h2/ops-h2.c
@@ -203,7 +203,7 @@ read:
 		ebuf.token = pt->serv_buf;
 		ebuf.len = lws_ssl_capable_read(wsi,
 					ebuf.token,
-					wsi->context->pt_serv_buf_size);
+					wsi->a.context->pt_serv_buf_size);
 		switch (ebuf.len) {
 		case 0:
 			lwsl_info("%s: zero length read\n", __func__);
@@ -248,7 +248,7 @@ drain:
 		 * callback and drain / re-enable it there
 		 */
 		if (user_callback_handle_rxflow(
-				wsi->protocol->callback,
+				wsi->a.protocol->callback,
 				wsi, LWS_CALLBACK_RECEIVE_CLIENT_HTTP,
 				wsi->user_space, NULL, 0)) {
 			lwsl_info("RECEIVE_CLIENT_HTTP closed it\n");
@@ -403,8 +403,8 @@ rops_write_role_protocol_h2(struct lws *wsi, unsigned char *buf, size_t len,
 	)) {
 		//assert(0);
 		lwsl_notice("%s: binning wsistate 0x%x %d: %s\n", __func__,
-				(unsigned int)wsi->wsistate, *wp, wsi->protocol ?
-					wsi->protocol->name : "no protocol");
+				(unsigned int)wsi->wsistate, *wp, wsi->a.protocol ?
+					wsi->a.protocol->name : "no protocol");
 
 		return 0;
 	}
@@ -502,7 +502,7 @@ rops_check_upgrades_h2(struct lws *wsi)
 	 * SETTINGS saying that we support it though.
 	 */
 	p = lws_hdr_simple_ptr(wsi, WSI_TOKEN_HTTP_COLON_METHOD);
-	if (!wsi->vhost->h2.set.s[H2SET_ENABLE_CONNECT_PROTOCOL] ||
+	if (!wsi->a.vhost->h2.set.s[H2SET_ENABLE_CONNECT_PROTOCOL] ||
 	    !wsi->mux_substream || !p || strcmp(p, "CONNECT"))
 		return LWS_UPG_RET_CONTINUE;
 
@@ -511,7 +511,7 @@ rops_check_upgrades_h2(struct lws *wsi)
 		return LWS_UPG_RET_CONTINUE;
 
 #if defined(LWS_WITH_SERVER_STATUS)
-	wsi->vhost->conn_stats.ws_upg++;
+	wsi->a.vhost->conn_stats.ws_upg++;
 #endif
 	lwsl_info("Upgrade h2 to ws\n");
 	lws_mux_mark_immortal(wsi);
@@ -609,7 +609,7 @@ rops_tx_credit_h2(struct lws *wsi, char peer_to_us, int add)
 static int
 rops_destroy_role_h2(struct lws *wsi)
 {
-	struct lws_context_per_thread *pt = &wsi->context->pt[(int)wsi->tsi];
+	struct lws_context_per_thread *pt = &wsi->a.context->pt[(int)wsi->tsi];
 	struct allocated_headers *ah;
 
 	/* we may not have an ah, but may be on the waiting list... */
@@ -652,7 +652,7 @@ rops_close_kill_connection_h2(struct lws *wsi, enum lws_close_status reason)
 
 		wsi->http.proxy_clientside = 0;
 
-		if (user_callback_handle_rxflow(wsi->protocol->callback,
+		if (user_callback_handle_rxflow(wsi->a.protocol->callback,
 						wsi,
 					    LWS_CALLBACK_COMPLETED_CLIENT_HTTP,
 						wsi->user_space, NULL, 0))
@@ -785,7 +785,7 @@ lws_h2_bind_for_post_before_action(struct lws *wsi)
 			if (hit->protocol)
 				name = hit->protocol;
 
-			pp = lws_vhost_name_to_protocol(wsi->vhost, name);
+			pp = lws_vhost_name_to_protocol(wsi->a.vhost, name);
 			if (!pp) {
 				lwsl_info("Unable to find protocol '%s'\n", name);
 				return 1;
@@ -796,7 +796,7 @@ lws_h2_bind_for_post_before_action(struct lws *wsi)
 		}
 
 		lwsl_info("%s: setting LRS_BODY from 0x%x (%s)\n", __func__,
-			    (int)wsi->wsistate, wsi->protocol->name);
+			    (int)wsi->wsistate, wsi->a.protocol->name);
 		lwsi_set_state(wsi, LRS_BODY);
 	}
 
@@ -1155,7 +1155,7 @@ rops_alpn_negotiated_h2(struct lws *wsi, const char *alpn)
 
 	wsi->upgraded_to_http2 = 1;
 #if defined(LWS_WITH_SERVER_STATUS)
-	wsi->vhost->conn_stats.h2_alpn++;
+	wsi->a.vhost->conn_stats.h2_alpn++;
 #endif
 
 	/* adopt the header info */
diff --git a/lib/roles/http/client/client-handshake.c b/lib/roles/http/client/client-handshake.c
index fd6cfd7dd..b86342c3b 100644
--- a/lib/roles/http/client/client-handshake.c
+++ b/lib/roles/http/client/client-handshake.c
@@ -62,7 +62,7 @@ lws_client_connect_4_established(struct lws *wsi, struct lws *wsi_piggyback,
 				 ssize_t plen)
 {
 #if defined(LWS_CLIENT_HTTP_PROXYING)
-	struct lws_context_per_thread *pt = &wsi->context->pt[(int)wsi->tsi];
+	struct lws_context_per_thread *pt = &wsi->a.context->pt[(int)wsi->tsi];
 #endif
 	const char *meth;
 	struct lws_pollfd pfd;
@@ -87,7 +87,7 @@ lws_client_connect_4_established(struct lws *wsi, struct lws *wsi_piggyback,
 	/* we are connected to server, or proxy */
 
 	/* http proxy */
-	if (wsi->vhost->http.http_proxy_port) {
+	if (wsi->a.vhost->http.http_proxy_port) {
 		const char *cpa;
 
 		cpa = lws_wsi_client_stash_item(wsi, CIS_ADDRESS,
@@ -104,10 +104,10 @@ lws_client_connect_4_established(struct lws *wsi, struct lws *wsi_piggyback,
 						   cpa, wsi->ocport);
 
 #if defined(LWS_WITH_HTTP_BASIC_AUTH)
-		if (wsi->vhost->proxy_basic_auth_token[0])
+		if (wsi->a.vhost->proxy_basic_auth_token[0])
 			plen += lws_snprintf((char *)pt->serv_buf + plen, 256,
 					"Proxy-authorization: basic %s\x0d\x0a",
-					wsi->vhost->proxy_basic_auth_token);
+					wsi->a.vhost->proxy_basic_auth_token);
 #endif
 
 		plen += lws_snprintf((char *)pt->serv_buf + plen, 5, "\x0d\x0a");
@@ -119,13 +119,13 @@ lws_client_connect_4_established(struct lws *wsi, struct lws *wsi_piggyback,
 		 */
 		if (wsi->stash)
 			wsi->stash->cis[CIS_ADDRESS] =
-				wsi->vhost->http.http_proxy_address;
+				wsi->a.vhost->http.http_proxy_address;
 		else
 			if (lws_hdr_simple_create(wsi,
 					_WSI_TOKEN_CLIENT_PEER_ADDRESS,
-					  wsi->vhost->http.http_proxy_address))
+					  wsi->a.vhost->http.http_proxy_address))
 			goto failed;
-		wsi->c_port = wsi->vhost->http.http_proxy_port;
+		wsi->c_port = wsi->a.vhost->http.http_proxy_port;
 
 		n = send(wsi->desc.sockfd, (char *)pt->serv_buf, (int)plen,
 			 MSG_NOSIGNAL);
@@ -136,7 +136,7 @@ lws_client_connect_4_established(struct lws *wsi, struct lws *wsi_piggyback,
 		}
 
 		lws_set_timeout(wsi, PENDING_TIMEOUT_AWAITING_PROXY_RESPONSE,
-				wsi->context->timeout_secs);
+				wsi->a.context->timeout_secs);
 
 		lwsi_set_state(wsi, LRS_WAITING_PROXY_REPLY);
 
@@ -192,7 +192,7 @@ send_hs:
 	} else {
 		lwsl_info("%s: wsi %p: %s %s client created own conn (raw %d) vh %sm st 0x%x\n",
 			    __func__, wsi, wsi->role_ops->name,
-			    wsi->protocol->name, rawish, wsi->vhost->name,
+			    wsi->a.protocol->name, rawish, wsi->a.vhost->name,
 			    lwsi_state(wsi));
 
 		/* we are making our own connection */
@@ -241,7 +241,7 @@ send_hs:
 				if (lwsi_state(wsi) != LRS_H2_WAITING_TO_SEND_HEADERS)
 					lwsi_set_state(wsi, LRS_H1C_ISSUE_HANDSHAKE2);
 				lws_set_timeout(wsi, PENDING_TIMEOUT_AWAITING_CLIENT_HS_SEND,
-						wsi->context->timeout_secs);
+						wsi->a.context->timeout_secs);
 
 				goto provoke_service;
 			}
@@ -253,7 +253,7 @@ send_hs:
 			m = wsi->role_ops->adoption_cb[0];
 			if (m) {
 				n = user_callback_handle_rxflow(
-						wsi->protocol->callback, wsi,
+						wsi->a.protocol->callback, wsi,
 						m, wsi->user_space, NULL, 0);
 				if (n < 0) {
 					lwsl_info("LWS_CALLBACK_RAW_PROXY_CLI_ADOPT failed\n");
@@ -279,7 +279,7 @@ send_hs:
 				 * provoke service to issue the CONNECT directly.
 				 */
 				lws_set_timeout(wsi, PENDING_TIMEOUT_SENT_CLIENT_HANDSHAKE,
-						wsi->context->timeout_secs);
+						wsi->a.context->timeout_secs);
 
 				assert(lws_socket_is_valid(wsi->desc.sockfd));
 
@@ -288,7 +288,7 @@ send_hs:
 				pfd.revents = LWS_POLLOUT;
 
 				lwsl_info("%s: going to service fd\n", __func__);
-				n = lws_service_fd(wsi->context, &pfd);
+				n = lws_service_fd(wsi->a.context, &pfd);
 				if (n < 0) {
 					cce = "first service failed";
 					goto failed;
@@ -318,7 +318,7 @@ send_hs:
 provoke_service:
 #endif
 		lws_set_timeout(wsi, PENDING_TIMEOUT_SENT_CLIENT_HANDSHAKE,
-				wsi->context->timeout_secs);
+				wsi->a.context->timeout_secs);
 
 		assert(lws_socket_is_valid(wsi->desc.sockfd));
 
@@ -326,7 +326,7 @@ provoke_service:
 		pfd.events = LWS_POLLIN;
 		pfd.revents = LWS_POLLIN;
 
-		n = lws_service_fd(wsi->context, &pfd);
+		n = lws_service_fd(wsi->a.context, &pfd);
 		if (n < 0) {
 			cce = "first service failed";
 			goto failed;
@@ -367,7 +367,7 @@ lws_client_connect_3_connect(struct lws *wsi, const char *ads,
 	struct sockaddr_un sau;
 #endif
 #ifdef LWS_WITH_IPV6
-	char ipv6only = lws_check_opt(wsi->vhost->options,
+	char ipv6only = lws_check_opt(wsi->a.vhost->options,
 				      LWS_SERVER_OPTION_IPV6_V6ONLY_MODIFY |
 				      LWS_SERVER_OPTION_IPV6_V6ONLY_VALUE);
 #endif
@@ -486,13 +486,13 @@ lws_client_connect_3_connect(struct lws *wsi, const char *ads,
 
 #if defined(LWS_WITH_DETAILED_LATENCY)
 	if (lwsi_state(wsi) == LRS_WAITING_DNS &&
-	    wsi->context->detailed_latency_cb) {
+	    wsi->a.context->detailed_latency_cb) {
 		wsi->detlat.type = LDLT_NAME_RESOLUTION;
 		wsi->detlat.latencies[LAT_DUR_PROXY_CLIENT_REQ_TO_WRITE] =
 			lws_now_usecs() -
 			wsi->detlat.earliest_write_req_pre_write;
 		wsi->detlat.latencies[LAT_DUR_USERCB] = 0;
-		lws_det_lat_cb(wsi->context, &wsi->detlat);
+		lws_det_lat_cb(wsi->a.context, &wsi->detlat);
 		wsi->detlat.earliest_write_req_pre_write = lws_now_usecs();
 	}
 #endif
@@ -503,9 +503,9 @@ lws_client_connect_3_connect(struct lws *wsi, const char *ads,
 	 *
 	 * Priority 1: connect to http proxy */
 
-	if (wsi->vhost->http.http_proxy_port) {
-		ads = wsi->vhost->http.http_proxy_address;
-		port = wsi->vhost->http.http_proxy_port;
+	if (wsi->a.vhost->http.http_proxy_port) {
+		ads = wsi->a.vhost->http.http_proxy_address;
+		port = wsi->a.vhost->http.http_proxy_port;
 #else
 		if (0) {
 #endif
@@ -514,15 +514,15 @@ lws_client_connect_3_connect(struct lws *wsi, const char *ads,
 
 	/* Priority 2: Connect to SOCK5 Proxy */
 
-	} else if (wsi->vhost->socks_proxy_port) {
+	} else if (wsi->a.vhost->socks_proxy_port) {
 		if (lws_socks5c_generate_msg(wsi, SOCKS_MSG_GREETING, &plen)) {
 			cce = "socks msg too large";
 			goto oom4;
 		}
 
 		lwsl_client("Sending SOCKS Greeting\n");
-		ads = wsi->vhost->socks_proxy_address;
-		port = wsi->vhost->socks_proxy_port;
+		ads = wsi->a.vhost->socks_proxy_address;
+		port = wsi->a.vhost->socks_proxy_port;
 #endif
 	}
 
@@ -613,8 +613,8 @@ ads_known:
 
 	if (!lws_socket_is_valid(wsi->desc.sockfd)) {
 
-		if (wsi->context->event_loop_ops->check_client_connect_ok &&
-		    wsi->context->event_loop_ops->check_client_connect_ok(wsi)) {
+		if (wsi->a.context->event_loop_ops->check_client_connect_ok &&
+		    wsi->a.context->event_loop_ops->check_client_connect_ok(wsi)) {
 			cce = "waiting for event loop watcher to close";
 			goto oom4;
 		}
@@ -632,7 +632,7 @@ ads_known:
 			goto try_next_result;
 		}
 
-		if (lws_plat_set_socket_options(wsi->vhost, wsi->desc.sockfd,
+		if (lws_plat_set_socket_options(wsi->a.vhost, wsi->desc.sockfd,
 #if defined(LWS_WITH_UNIX_SOCK)
 						wsi->unix_skt)) {
 #else
@@ -645,11 +645,11 @@ ads_known:
 		lwsl_debug("%s: %p: WAITING_CONNECT\n", __func__, wsi);
 		lwsi_set_state(wsi, LRS_WAITING_CONNECT);
 
-		if (wsi->context->event_loop_ops->sock_accept)
-			if (wsi->context->event_loop_ops->sock_accept(wsi))
+		if (wsi->a.context->event_loop_ops->sock_accept)
+			if (wsi->a.context->event_loop_ops->sock_accept(wsi))
 				goto try_next_result_closesock;
 
-		if (__insert_wsi_socket_into_fds(wsi->context, wsi))
+		if (__insert_wsi_socket_into_fds(wsi->a.context, wsi))
 			goto try_next_result_closesock;
 
 		/*
@@ -666,17 +666,17 @@ ads_known:
 		if (lws_change_pollfd(wsi, 0, LWS_POLLIN))
 			goto try_next_result_fds;
 
-		if (!wsi->protocol)
-			wsi->protocol = &wsi->vhost->protocols[0];
+		if (!wsi->a.protocol)
+			wsi->a.protocol = &wsi->a.vhost->protocols[0];
 
 		lws_set_timeout(wsi, PENDING_TIMEOUT_AWAITING_CONNECT_RESPONSE,
-				wsi->vhost->connect_timeout_secs);
+				wsi->a.vhost->connect_timeout_secs);
 
 		iface = lws_wsi_client_stash_item(wsi, CIS_IFACE,
 						  _WSI_TOKEN_CLIENT_IFACE);
 
 		if (iface && *iface) {
-			m = lws_socket_bind(wsi->vhost, wsi->desc.sockfd, 0,
+			m = lws_socket_bind(wsi->a.vhost, wsi->desc.sockfd, 0,
 					    iface, wsi->ipv6);
 			if (m < 0)
 				goto try_next_result_fds;
@@ -744,9 +744,9 @@ ads_known:
 		 * purpose
 		 */
 
-		lws_sul_schedule(wsi->context, 0, &wsi->sul_connect_timeout,
+		lws_sul_schedule(wsi->a.context, 0, &wsi->sul_connect_timeout,
 				 lws_client_conn_wait_timeout,
-				 wsi->context->timeout_secs * LWS_USEC_PER_SEC);
+				 wsi->a.context->timeout_secs * LWS_USEC_PER_SEC);
 
 		/*
 		 * must do specifically a POLLOUT poll to hear
@@ -767,13 +767,13 @@ conn_good:
 	/* the tcp connection has happend */
 
 #if defined(LWS_WITH_DETAILED_LATENCY)
-	if (wsi->context->detailed_latency_cb) {
+	if (wsi->a.context->detailed_latency_cb) {
 		wsi->detlat.type = LDLT_CONNECTION;
 		wsi->detlat.latencies[LAT_DUR_PROXY_CLIENT_REQ_TO_WRITE] =
 			lws_now_usecs() -
 			wsi->detlat.earliest_write_req_pre_write;
 		wsi->detlat.latencies[LAT_DUR_USERCB] = 0;
-		lws_det_lat_cb(wsi->context, &wsi->detlat);
+		lws_det_lat_cb(wsi->a.context, &wsi->detlat);
 		wsi->detlat.earliest_write_req =
 			wsi->detlat.earliest_write_req_pre_write =
 							lws_now_usecs();
@@ -782,8 +782,8 @@ conn_good:
 
 	lws_addrinfo_clean(wsi);
 
-	if (wsi->protocol)
-		wsi->protocol->callback(wsi, LWS_CALLBACK_WSI_CREATE,
+	if (wsi->a.protocol)
+		wsi->a.protocol->callback(wsi, LWS_CALLBACK_WSI_CREATE,
 					wsi->user_space, NULL, 0);
 
 	lwsl_debug("%s: going into connect_4\n", __func__);
@@ -795,7 +795,7 @@ oom4:
 	 * didn't make it as far as getting inserted into the wsi / fd tables
 	 */
 
-	if (lwsi_role_client(wsi) && wsi->protocol /* && lwsi_state_est(wsi) */)
+	if (lwsi_role_client(wsi) && wsi->a.protocol /* && lwsi_state_est(wsi) */)
 		lws_inform_client_conn_fail(wsi,(void *)cce, strlen(cce));
 
 	/* take care that we might be inserted in fds already */
@@ -811,7 +811,7 @@ oom4:
 	 * so nobody else should have had a chance to queue on us.
 	 */
 	{
-		struct lws_vhost *vhost = wsi->vhost;
+		struct lws_vhost *vhost = wsi->a.vhost;
 		lws_sockfd_type sfd = wsi->desc.sockfd;
 
 		lws_vhost_lock(vhost);
@@ -914,7 +914,7 @@ lws_client_connect_2_dnsreq(struct lws *wsi)
 		lwsl_notice("%s: ACTIVE_CONNS_MUXED\n", __func__);
 		if (lwsi_role_h2(wsi)) {
 
-			if (wsi->protocol->callback(wsi,
+			if (wsi->a.protocol->callback(wsi,
 						    LWS_CALLBACK_ESTABLISHED_CLIENT_HTTP,
 						    wsi->user_space, NULL, 0))
 				goto failed1;
@@ -973,12 +973,12 @@ solo:
 		     !strcmp(meth, "MQTT")) &&
 	    lws_dll2_is_detached(&wsi->dll2_cli_txn_queue) &&
 	    lws_dll2_is_detached(&wsi->dll_cli_active_conns)) {
-		lws_vhost_lock(wsi->vhost);
+		lws_vhost_lock(wsi->a.vhost);
 		lwsl_info("%s: adding active conn %p\n", __func__, wsi);
 		/* caution... we will have to unpick this on oom4 path */
 		lws_dll2_add_head(&wsi->dll_cli_active_conns,
-				 &wsi->vhost->dll_cli_active_conns_owner);
-		lws_vhost_unlock(wsi->vhost);
+				 &wsi->a.vhost->dll_cli_active_conns_owner);
+		lws_vhost_unlock(wsi->a.vhost);
 	}
 
 	/*
@@ -1000,7 +1000,7 @@ solo:
 	/*
 	 * start off allowing ipv6 on connection if vhost allows it
 	 */
-	wsi->ipv6 = LWS_IPV6_ENABLED(wsi->vhost);
+	wsi->ipv6 = LWS_IPV6_ENABLED(wsi->a.vhost);
 #ifdef LWS_WITH_IPV6
 	if (wsi->stash)
 		iface = wsi->stash->cis[CIS_IFACE];
@@ -1016,13 +1016,13 @@ solo:
 
 #if defined(LWS_WITH_DETAILED_LATENCY)
 	if (lwsi_state(wsi) == LRS_WAITING_DNS &&
-	    wsi->context->detailed_latency_cb) {
+	    wsi->a.context->detailed_latency_cb) {
 		wsi->detlat.type = LDLT_NAME_RESOLUTION;
 		wsi->detlat.latencies[LAT_DUR_PROXY_CLIENT_REQ_TO_WRITE] =
 			lws_now_usecs() -
 			wsi->detlat.earliest_write_req_pre_write;
 		wsi->detlat.latencies[LAT_DUR_USERCB] = 0;
-		lws_det_lat_cb(wsi->context, &wsi->detlat);
+		lws_det_lat_cb(wsi->a.context, &wsi->detlat);
 		wsi->detlat.earliest_write_req_pre_write = lws_now_usecs();
 	}
 #endif
@@ -1034,9 +1034,9 @@ solo:
 	 *
 	 * Priority 1: connect to http proxy */
 
-	if (wsi->vhost->http.http_proxy_port) {
-		ads = wsi->vhost->http.http_proxy_address;
-		port = wsi->vhost->http.http_proxy_port;
+	if (wsi->a.vhost->http.http_proxy_port) {
+		ads = wsi->a.vhost->http.http_proxy_address;
+		port = wsi->a.vhost->http.http_proxy_port;
 #else
 		if (0) {
 #endif
@@ -1045,10 +1045,10 @@ solo:
 
 	/* Priority 2: Connect to SOCK5 Proxy */
 
-	} else if (wsi->vhost->socks_proxy_port) {
+	} else if (wsi->a.vhost->socks_proxy_port) {
 		lwsl_client("Sending SOCKS Greeting\n");
-		ads = wsi->vhost->socks_proxy_address;
-		port = wsi->vhost->socks_proxy_port;
+		ads = wsi->a.vhost->socks_proxy_address;
+		port = wsi->a.vhost->socks_proxy_port;
 #endif
 	} else {
 
@@ -1079,7 +1079,7 @@ solo:
 	lwsi_set_state(wsi, LRS_WAITING_DNS);
 	/* this is either FAILED, CONTINUING, or already called connect_4 */
 
-	n = lws_async_dns_query(wsi->context, wsi->tsi, ads, LWS_ADNS_RECORD_A,
+	n = lws_async_dns_query(wsi->a.context, wsi->tsi, ads, LWS_ADNS_RECORD_A,
 				lws_client_connect_3_connect, wsi, NULL);
 	if (n == LADNS_RET_FAILED_WSI_CLOSED)
 		return NULL;
@@ -1232,8 +1232,8 @@ lws_client_reset(struct lws **pwsi, int ssl, const char *address, int port,
 	if (wsi->role_ops && wsi->role_ops->close_kill_connection)
 		wsi->role_ops->close_kill_connection(wsi, 1);
 
-	if (wsi->context->event_loop_ops->close_handle_manually)
-		wsi->context->event_loop_ops->close_handle_manually(wsi);
+	if (wsi->a.context->event_loop_ops->close_handle_manually)
+		wsi->a.context->event_loop_ops->close_handle_manually(wsi);
 	else
 		if (wsi->desc.sockfd != LWS_SOCK_INVALID)
 			compatible_close(wsi->desc.sockfd);
@@ -1250,8 +1250,8 @@ lws_client_reset(struct lws **pwsi, int ssl, const char *address, int port,
 	}
 #endif
 
-	if (wsi->protocol && wsi->role_ops && wsi->protocol_bind_balance) {
-		wsi->protocol->callback(wsi,
+	if (wsi->a.protocol && wsi->role_ops && wsi->protocol_bind_balance) {
+		wsi->a.protocol->callback(wsi,
 				wsi->role_ops->protocol_unbind_cb[
 				       !!lwsi_role_server(wsi)],
 				       wsi->user_space, (void *)__func__, 0);
@@ -1261,9 +1261,9 @@ lws_client_reset(struct lws **pwsi, int ssl, const char *address, int port,
 
 	wsi->desc.sockfd = LWS_SOCK_INVALID;
 	lws_role_transition(wsi, LWSIFR_CLIENT, LRS_UNCONNECTED, &role_ops_h1);
-//	wsi->protocol = NULL;
-	if (wsi->protocol)
-		lws_bind_protocol(wsi, wsi->protocol, "client_reset");
+//	wsi->a.protocol = NULL;
+	if (wsi->a.protocol)
+		lws_bind_protocol(wsi, wsi->a.protocol, "client_reset");
 	wsi->pending_timeout = NO_PENDING_TIMEOUT;
 	wsi->c_port = port;
 	wsi->hdr_parsing_completed = 0;
@@ -1464,8 +1464,8 @@ html_parser_cb(const hubbub_token *token, void *pw)
 		break;
 	}
 
-	if (r->wsi->protocol_bind_balance &&
-	    user_callback_handle_rxflow(r->wsi->protocol->callback,
+	if (r->wsi->a.protocol_bind_balance &&
+	    user_callback_handle_rxflow(r->wsi->a.protocol->callback,
 			r->wsi, LWS_CALLBACK_RECEIVE_CLIENT_HTTP_READ,
 			r->wsi->user_space, start, p - start))
 		return -1;
@@ -1498,7 +1498,7 @@ lws_http_client_connect_via_info2(struct lws *wsi)
 	if (!stash)
 		return wsi;
 
-	wsi->opaque_user_data = wsi->stash->opaque_user_data;
+	wsi->a.opaque_user_data = wsi->stash->opaque_user_data;
 
 	if (stash->cis[CIS_METHOD] && (!strcmp(stash->cis[CIS_METHOD], "RAW") ||
 				      !strcmp(stash->cis[CIS_METHOD], "MQTT")))
@@ -1516,18 +1516,18 @@ lws_http_client_connect_via_info2(struct lws *wsi)
 		}
 
 #if defined(LWS_WITH_SOCKS5)
-	if (!wsi->vhost->socks_proxy_port)
+	if (!wsi->a.vhost->socks_proxy_port)
 		lws_free_set_NULL(wsi->stash);
 #endif
 
 no_ah:
-	wsi->context->count_wsi_allocated++;
+	wsi->a.context->count_wsi_allocated++;
 
 	return lws_client_connect_2_dnsreq(wsi);
 
 bail1:
 #if defined(LWS_WITH_SOCKS5)
-	if (!wsi->vhost->socks_proxy_port)
+	if (!wsi->a.vhost->socks_proxy_port)
 		lws_free_set_NULL(wsi->stash);
 #endif
 
diff --git a/lib/roles/http/client/client-http.c b/lib/roles/http/client/client-http.c
index 00db780fe..1aab99925 100644
--- a/lib/roles/http/client/client-http.c
+++ b/lib/roles/http/client/client-http.c
@@ -42,7 +42,7 @@ lws_client_create_tls(struct lws *wsi, const char **pcce, int do_c1)
 
 #if defined(LWS_WITH_TLS)
 			if (!wsi->transaction_from_pipeline_queue &&
-			    lws_tls_restrict_borrow(wsi->context)) {
+			    lws_tls_restrict_borrow(wsi->a.context)) {
 				*pcce = "tls restriction limit";
 				return CCTLS_RETURN_ERROR;
 			}
@@ -52,13 +52,13 @@ lws_client_create_tls(struct lws *wsi, const char **pcce, int do_c1)
 		if (!do_c1)
 			return 0;
 
-		n = lws_ssl_client_connect1(wsi, (char *)wsi->context->pt[(int)wsi->tsi].serv_buf,
-					    wsi->context->pt_serv_buf_size);
+		n = lws_ssl_client_connect1(wsi, (char *)wsi->a.context->pt[(int)wsi->tsi].serv_buf,
+					    wsi->a.context->pt_serv_buf_size);
 		lwsl_debug("%s: lws_ssl_client_connect1: %d\n", __func__, n);
 		if (!n)
 			return CCTLS_RETURN_RETRY; /* caller should return 0 */
 		if (n < 0) {
-			*pcce = (const char *)wsi->context->pt[(int)wsi->tsi].serv_buf;
+			*pcce = (const char *)wsi->a.context->pt[(int)wsi->tsi].serv_buf;
 			return CCTLS_RETURN_ERROR;
 		}
 	} else
@@ -99,7 +99,7 @@ lws_client_http_body_pending(struct lws *wsi, int something_left_to_send)
 int
 lws_client_socket_service(struct lws *wsi, struct lws_pollfd *pollfd)
 {
-	struct lws_context *context = wsi->context;
+	struct lws_context *context = wsi->a.context;
 	struct lws_context_per_thread *pt = &context->pt[(int)wsi->tsi];
 	char *p = (char *)&pt->serv_buf[0];
 #if defined(LWS_WITH_TLS)
@@ -250,7 +250,7 @@ start_ws_handshake:
 				lws_now_usecs() -
 				wsi->detlat.earliest_write_req_pre_write;
 			wsi->detlat.latencies[LAT_DUR_USERCB] = 0;
-			lws_det_lat_cb(wsi->context, &wsi->detlat);
+			lws_det_lat_cb(wsi->a.context, &wsi->detlat);
 		}
 #endif
 #if defined (LWS_WITH_HTTP2)
@@ -356,7 +356,7 @@ start_ws_handshake:
 		}
 
 		lws_set_timeout(wsi, PENDING_TIMEOUT_AWAITING_SERVER_RESPONSE,
-				wsi->context->timeout_secs);
+				wsi->a.context->timeout_secs);
 
 		lws_callback_on_writable(wsi);
 
@@ -505,9 +505,9 @@ lws_http_transaction_completed_client(struct lws *wsi)
 {
 	int n;
 
-	lwsl_info("%s: wsi: %p (%s)\n", __func__, wsi, wsi->protocol->name);
+	lwsl_info("%s: wsi: %p (%s)\n", __func__, wsi, wsi->a.protocol->name);
 
-	if (user_callback_handle_rxflow(wsi->protocol->callback, wsi,
+	if (user_callback_handle_rxflow(wsi->a.protocol->callback, wsi,
 					LWS_CALLBACK_COMPLETED_CLIENT_HTTP,
 					wsi->user_space, NULL, 0)) {
 		lwsl_debug("%s: Completed call returned nonzero (role 0x%lx)\n",
@@ -552,7 +552,7 @@ lws_http_transaction_completed_client(struct lws *wsi)
 	wsi->http.ah->unk_pos = 0;
 
 	lws_set_timeout(wsi, PENDING_TIMEOUT_AWAITING_SERVER_RESPONSE,
-			wsi->context->timeout_secs);
+			wsi->a.context->timeout_secs);
 
 	/* If we're (re)starting on headers, need other implied init */
 	wsi->http.ah->ues = URIES_IDLE;
@@ -690,7 +690,7 @@ lws_client_interpret_server_handshake(struct lws *wsi)
 
 		/* let's let the user code know, if he cares */
 
-		if (wsi->protocol->callback(wsi,
+		if (wsi->a.protocol->callback(wsi,
 					    LWS_CALLBACK_CLIENT_HTTP_REDIRECT,
 					    wsi->user_space, p, n)) {
 			cce = "HS: user code rejected redirect";
@@ -821,7 +821,7 @@ lws_client_interpret_server_handshake(struct lws *wsi)
 			 */
 			wsi->keepalive_rejected = 1;
 
-			lws_vhost_lock(wsi->vhost);
+			lws_vhost_lock(wsi->a.vhost);
 			lws_start_foreach_dll_safe(struct lws_dll2 *,
 						   d, d1,
 			  wsi->dll2_cli_txn_queue_owner.head) {
@@ -848,7 +848,7 @@ lws_client_interpret_server_handshake(struct lws *wsi)
 #endif
 				ww->user_space = NULL;
 			} lws_end_foreach_dll_safe(d, d1);
-			lws_vhost_unlock(wsi->vhost);
+			lws_vhost_unlock(wsi->a.vhost);
 		}
 	}
 
@@ -897,7 +897,7 @@ lws_client_interpret_server_handshake(struct lws *wsi)
 		 * before the ws upgrade code discard it. ie: download reply body in case
 		 * of any other response code than 101.
 		 */
-		if (wsi->protocol->callback(wsi,
+		if (wsi->a.protocol->callback(wsi,
 					  LWS_CALLBACK_ESTABLISHED_CLIENT_HTTP,
 					  wsi->user_space, NULL, 0)) {
 
@@ -919,7 +919,7 @@ lws_client_interpret_server_handshake(struct lws *wsi)
 		 */
 		ah1 = wsi->http.ah;
 		wsi->http.ah = ah;
-		if (wsi->protocol->callback(wsi,
+		if (wsi->a.protocol->callback(wsi,
 				LWS_CALLBACK_CLIENT_FILTER_PRE_ESTABLISH,
 					    wsi->user_space, NULL, 0)) {
 			wsi->http.ah = ah1;
@@ -933,7 +933,7 @@ lws_client_interpret_server_handshake(struct lws *wsi)
 		wsi->rxflow_change_to = LWS_RXFLOW_ALLOW;
 
 		/* call him back to inform him he is up */
-		if (wsi->protocol->callback(wsi,
+		if (wsi->a.protocol->callback(wsi,
 					    LWS_CALLBACK_ESTABLISHED_CLIENT_HTTP,
 					    wsi->user_space, NULL, 0)) {
 			wsi->http.ah = ah1;
@@ -987,7 +987,7 @@ bail3:
 	close_reason = LWS_CLOSE_STATUS_NOSTATUS;
 
 bail2:
-	if (wsi->protocol) {
+	if (wsi->a.protocol) {
 		n = 0;
 		if (cce)
 			n = (int)strlen(cce);
@@ -996,8 +996,8 @@ bail2:
 	}
 
 	lwsl_info("closing connection (prot %s) "
-		  "due to bail2 connection error: %s\n", wsi->protocol ?
-				  wsi->protocol->name : "unknown", cce);
+		  "due to bail2 connection error: %s\n", wsi->a.protocol ?
+				  wsi->a.protocol->name : "unknown", cce);
 
 	/* closing will free up his parsing allocations */
 	lws_close_free_wsi(wsi, close_reason, "c hs interp");
@@ -1016,7 +1016,7 @@ lws_http_multipart_headers(struct lws *wsi, uint8_t *p)
 	char buf[10], arg[48];
 	int n;
 
-	lws_get_random(wsi->context, (uint8_t *)buf, sizeof(buf));
+	lws_get_random(wsi->a.context, (uint8_t *)buf, sizeof(buf));
 	lws_b64_encode_string(buf, sizeof(buf),
 			       wsi->http.multipart_boundary,
 			       sizeof(wsi->http.multipart_boundary));
@@ -1096,7 +1096,7 @@ lws_generate_client_handshake(struct lws *wsi, char *pkt)
 		if (pp) {
 			const struct lws_protocols *pr;
 
-			pr = lws_vhost_name_to_protocol(wsi->vhost, pp);
+			pr = lws_vhost_name_to_protocol(wsi->a.vhost, pp);
 
 			if (!pr) {
 				lwsl_err("protocol %s not enabled on vhost\n",
@@ -1107,7 +1107,7 @@ lws_generate_client_handshake(struct lws *wsi, char *pkt)
 			lws_bind_protocol(wsi, pr, __func__);
 		}
 
-		if ((wsi->protocol->callback)(wsi, LWS_CALLBACK_RAW_ADOPT,
+		if ((wsi->a.protocol->callback)(wsi, LWS_CALLBACK_RAW_ADOPT,
 					      wsi->user_space, NULL, 0))
 			return NULL;
 
@@ -1141,7 +1141,7 @@ lws_generate_client_handshake(struct lws *wsi, char *pkt)
 		     lws_hdr_simple_ptr(wsi, _WSI_TOKEN_CLIENT_HOST));
 
 	if (lws_hdr_simple_ptr(wsi, _WSI_TOKEN_CLIENT_ORIGIN)) {
-		if (lws_check_opt(wsi->context->options,
+		if (lws_check_opt(wsi->a.context->options,
 				  LWS_SERVER_OPTION_JUST_USE_RAW_ORIGIN))
 			p += lws_snprintf(p, 128, "Origin: %s\x0d\x0a",
 				     lws_hdr_simple_ptr(wsi,
@@ -1194,10 +1194,10 @@ lws_generate_client_handshake(struct lws *wsi, char *pkt)
 
 	/* give userland a chance to append, eg, cookies */
 
-	if (wsi->protocol->callback(wsi,
+	if (wsi->a.protocol->callback(wsi,
 			LWS_CALLBACK_CLIENT_APPEND_HANDSHAKE_HEADER,
 			wsi->user_space, &p,
-			(pkt + wsi->context->pt_serv_buf_size) - p - 12))
+			(pkt + wsi->a.context->pt_serv_buf_size) - p - 12))
 		return NULL;
 
 	if (wsi->flags & LCCSCF_HTTP_X_WWW_FORM_URLENCODED) {
@@ -1245,7 +1245,7 @@ lws_http_basic_auth_gen(const char *user, const char *pw, char *buf, size_t len)
 int
 lws_http_client_read(struct lws *wsi, char **buf, int *len)
 {
-	struct lws_context_per_thread *pt = &wsi->context->pt[(int)wsi->tsi];
+	struct lws_context_per_thread *pt = &wsi->a.context->pt[(int)wsi->tsi];
 	struct lws_tokens eb;
 	int buffered, n, consumed = 0;
 
@@ -1425,7 +1425,7 @@ spin_chunks:
 		    !!wsi->protocol_bind_balance
 #endif
 		  ) {
-			if (user_callback_handle_rxflow(wsi->protocol->callback,
+			if (user_callback_handle_rxflow(wsi->a.protocol->callback,
 				wsi, LWS_CALLBACK_RECEIVE_CLIENT_HTTP_READ,
 				wsi->user_space, *buf, n)) {
 				lwsl_info("%s: RECEIVE_CLIENT_HTTP_READ returned -1\n",
diff --git a/lib/roles/http/header.c b/lib/roles/http/header.c
index 666042c39..f505fd759 100644
--- a/lib/roles/http/header.c
+++ b/lib/roles/http/header.c
@@ -326,7 +326,7 @@ lws_add_http_header_status(struct lws *wsi, unsigned int _code,
 			return 1;
 	}
 
-	headers = wsi->vhost->headers;
+	headers = wsi->a.vhost->headers;
 	while (headers) {
 		if (lws_add_http_header_by_name(wsi,
 				(const unsigned char *)headers->name,
@@ -337,7 +337,7 @@ lws_add_http_header_status(struct lws *wsi, unsigned int _code,
 		headers = headers->next;
 	}
 
-	if (wsi->vhost->options &
+	if (wsi->a.vhost->options &
 	    LWS_SERVER_OPTION_HTTP_HEADERS_SECURITY_BEST_PRACTICES_ENFORCE) {
 		headers = &pvo_hsbph[LWS_ARRAY_SIZE(pvo_hsbph) - 1];
 		while (headers) {
@@ -351,16 +351,16 @@ lws_add_http_header_status(struct lws *wsi, unsigned int _code,
 		}
 	}
 
-	if (wsi->context->server_string &&
+	if (wsi->a.context->server_string &&
 	    !(_code & LWSAHH_FLAG_NO_SERVER_NAME)) {
-		assert(wsi->context->server_string_len > 0);
+		assert(wsi->a.context->server_string_len > 0);
 		if (lws_add_http_header_by_token(wsi, WSI_TOKEN_HTTP_SERVER,
-				(unsigned char *)wsi->context->server_string,
-				wsi->context->server_string_len, p, end))
+				(unsigned char *)wsi->a.context->server_string,
+				wsi->a.context->server_string_len, p, end))
 			return 1;
 	}
 
-	if (wsi->vhost->options & LWS_SERVER_OPTION_STS)
+	if (wsi->a.vhost->options & LWS_SERVER_OPTION_STS)
 		if (lws_add_http_header_by_name(wsi, (unsigned char *)
 				"Strict-Transport-Security:",
 				(unsigned char *)"max-age=15768000 ; "
@@ -389,19 +389,19 @@ lws_return_http_status(struct lws *wsi, unsigned int code,
 	int n = 0, m = 0, len;
 	char slen[20];
 
-	if (!wsi->vhost) {
+	if (!wsi->a.vhost) {
 		lwsl_err("%s: wsi not bound to vhost\n", __func__);
 
 		return 1;
 	}
 #if defined(LWS_ROLE_H1) || defined(LWS_ROLE_H2)
 	if (!wsi->handling_404 &&
-	    wsi->vhost->http.error_document_404 &&
+	    wsi->a.vhost->http.error_document_404 &&
 	    code == HTTP_STATUS_NOT_FOUND)
 		/* we should do a redirect, and do the 404 there */
 		if (lws_http_redirect(wsi, HTTP_STATUS_FOUND,
-			       (uint8_t *)wsi->vhost->http.error_document_404,
-			       (int)strlen(wsi->vhost->http.error_document_404),
+			       (uint8_t *)wsi->a.vhost->http.error_document_404,
+			       (int)strlen(wsi->a.vhost->http.error_document_404),
 			       &p, end) > 0)
 			return 0;
 #endif
@@ -570,9 +570,9 @@ lws_sul_http_ah_lifecheck(lws_sorted_usec_list_t *sul)
 		const unsigned char *c;
 
 		if (!ah->in_use || !ah->wsi || !ah->assigned ||
-		    (ah->wsi->vhost &&
+		    (ah->wsi->a.vhost &&
 		     (now - ah->assigned) <
-		     ah->wsi->vhost->timeout_secs_ah_idle + 360)) {
+		     ah->wsi->a.vhost->timeout_secs_ah_idle + 360)) {
 			ah = ah->next;
 			continue;
 		}
diff --git a/lib/roles/http/parsers.c b/lib/roles/http/parsers.c
index 5973b9005..a59f0f480 100644
--- a/lib/roles/http/parsers.c
+++ b/lib/roles/http/parsers.c
@@ -124,7 +124,7 @@ __lws_header_table_reset(struct lws *wsi, int autoservice)
 
 	/* while we hold the ah, keep a timeout on the wsi */
 	__lws_set_timeout(wsi, PENDING_TIMEOUT_HOLDING_AH,
-			  wsi->vhost->timeout_secs_ah_idle);
+			  wsi->a.vhost->timeout_secs_ah_idle);
 
 	time(&ah->assigned);
 
@@ -133,7 +133,7 @@ __lws_header_table_reset(struct lws *wsi, int autoservice)
 	    autoservice) {
 		lwsl_debug("%s: service on readbuf ah\n", __func__);
 
-		pt = &wsi->context->pt[(int)wsi->tsi];
+		pt = &wsi->a.context->pt[(int)wsi->tsi];
 		/*
 		 * Unlike a normal connect, we have the headers already
 		 * (or the first part of them anyway)
@@ -141,14 +141,14 @@ __lws_header_table_reset(struct lws *wsi, int autoservice)
 		pfd = &pt->fds[wsi->position_in_fds_table];
 		pfd->revents |= LWS_POLLIN;
 		lwsl_err("%s: calling service\n", __func__);
-		lws_service_fd_tsi(wsi->context, pfd, wsi->tsi);
+		lws_service_fd_tsi(wsi->a.context, pfd, wsi->tsi);
 	}
 }
 
 void
 lws_header_table_reset(struct lws *wsi, int autoservice)
 {
-	struct lws_context_per_thread *pt = &wsi->context->pt[(int)wsi->tsi];
+	struct lws_context_per_thread *pt = &wsi->a.context->pt[(int)wsi->tsi];
 
 	lws_pt_lock(pt, __func__);
 
@@ -160,7 +160,7 @@ lws_header_table_reset(struct lws *wsi, int autoservice)
 static void
 _lws_header_ensure_we_are_on_waiting_list(struct lws *wsi)
 {
-	struct lws_context_per_thread *pt = &wsi->context->pt[(int)wsi->tsi];
+	struct lws_context_per_thread *pt = &wsi->a.context->pt[(int)wsi->tsi];
 	struct lws_pollargs pa;
 	struct lws **pwsi = &pt->http.ah_wait_list;
 
@@ -183,7 +183,7 @@ _lws_header_ensure_we_are_on_waiting_list(struct lws *wsi)
 static int
 __lws_remove_from_ah_waiting_list(struct lws *wsi)
 {
-        struct lws_context_per_thread *pt = &wsi->context->pt[(int)wsi->tsi];
+        struct lws_context_per_thread *pt = &wsi->a.context->pt[(int)wsi->tsi];
 	struct lws **pwsi =&pt->http.ah_wait_list;
 
 	while (*pwsi) {
@@ -206,7 +206,7 @@ __lws_remove_from_ah_waiting_list(struct lws *wsi)
 int LWS_WARN_UNUSED_RESULT
 lws_header_table_attach(struct lws *wsi, int autoservice)
 {
-	struct lws_context *context = wsi->context;
+	struct lws_context *context = wsi->a.context;
 	struct lws_context_per_thread *pt = &context->pt[(int)wsi->tsi];
 	struct lws_pollargs pa;
 	int n;
@@ -308,7 +308,7 @@ bail:
 
 int __lws_header_table_detach(struct lws *wsi, int autoservice)
 {
-	struct lws_context *context = wsi->context;
+	struct lws_context *context = wsi->a.context;
 	struct allocated_headers *ah = wsi->http.ah;
 	struct lws_context_per_thread *pt = &context->pt[(int)wsi->tsi];
 	struct lws_pollargs pa;
@@ -451,7 +451,7 @@ nobody_usable_waiting:
 
 int lws_header_table_detach(struct lws *wsi, int autoservice)
 {
-	struct lws_context *context = wsi->context;
+	struct lws_context *context = wsi->a.context;
 	struct lws_context_per_thread *pt = &context->pt[(int)wsi->tsi];
 	int n;
 
@@ -659,10 +659,10 @@ lws_pos_in_bounds(struct lws *wsi)
 		return -1;
 
 	if (wsi->http.ah->pos <
-	    (unsigned int)wsi->context->max_http_header_data)
+	    (unsigned int)wsi->a.context->max_http_header_data)
 		return 0;
 
-	if ((int)wsi->http.ah->pos >= wsi->context->max_http_header_data - 1) {
+	if ((int)wsi->http.ah->pos >= wsi->a.context->max_http_header_data - 1) {
 		lwsl_err("Ran out of header data space\n");
 		return 1;
 	}
@@ -673,7 +673,7 @@ lws_pos_in_bounds(struct lws *wsi)
 	 */
 	lwsl_err("%s: pos %ld, limit %ld\n", __func__,
 		 (unsigned long)wsi->http.ah->pos,
-		 (unsigned long)wsi->context->max_http_header_data);
+		 (unsigned long)wsi->a.context->max_http_header_data);
 	assert(0);
 
 	return 1;
@@ -961,7 +961,7 @@ lws_parser_return_t LWS_WARN_UNUSED_RESULT
 lws_parse(struct lws *wsi, unsigned char *buf, int *len)
 {
 	struct allocated_headers *ah = wsi->http.ah;
-	struct lws_context *context = wsi->context;
+	struct lws_context *context = wsi->a.context;
 	unsigned int n, m;
 	unsigned char c;
 	int r, pos;
@@ -1282,7 +1282,7 @@ nope:
 				 * Are we set up to transition to another role
 				 * in these cases?
 				 */
-				if (lws_check_opt(wsi->vhost->options,
+				if (lws_check_opt(wsi->a.vhost->options,
 		    LWS_SERVER_OPTION_FALLBACK_TO_APPLY_LISTEN_ACCEPT_CONFIG)) {
 					lwsl_notice("%s: http fail fallback\n",
 						    __func__);
@@ -1352,7 +1352,7 @@ nope:
 							      ah->parser_state];
 				else
 					ah->current_token_limit =
-						wsi->context->max_http_header_data;
+						wsi->a.context->max_http_header_data;
 
 				if (ah->parser_state == WSI_TOKEN_CHALLENGE)
 					goto set_parsing_complete;
@@ -1524,7 +1524,7 @@ lws_jwt_get_http_cookie_validate_jwt(struct lws *wsi,
 
 	/* decode the JWT into temp */
 
-	if (lws_jwt_signed_validate(wsi->context, i->jwk, i->alg, out,
+	if (lws_jwt_signed_validate(wsi->a.context, i->jwk, i->alg, out,
 				    *out_len, temp, sizeof(temp), out, &cml)) {
 		lwsl_notice("%s: jwt validation failed\n", __func__);
 		return 1;
@@ -1574,9 +1574,9 @@ lws_jwt_sign_token_set_http_cookie(struct lws *wsi,
 	 * Create a 16-char random csrf token with the same lifetime as the JWT
 	 */
 
-	lws_hex_random(wsi->context, csrf, sizeof(csrf));
+	lws_hex_random(wsi->a.context, csrf, sizeof(csrf));
 	ull = lws_now_secs();
-	if (lws_jwt_sign_compact(wsi->context, i->jwk, i->alg, plain, &pl,
+	if (lws_jwt_sign_compact(wsi->a.context, i->jwk, i->alg, plain, &pl,
 			         temp, sizeof(temp),
 			         "{\"iss\":\"%s\",\"aud\":\"%s\","
 			          "\"iat\":%llu,\"nbf\":%llu,\"exp\":%llu,"
diff --git a/lib/roles/http/server/access-log.c b/lib/roles/http/server/access-log.c
index 0ac261066..12aebde11 100644
--- a/lib/roles/http/server/access-log.c
+++ b/lib/roles/http/server/access-log.c
@@ -50,11 +50,11 @@ lws_prepare_access_log_info(struct lws *wsi, char *uri_ptr, int uri_len, int met
 	int l = 256, m;
 	struct tm *tmp;
 
-	if (!wsi->vhost)
+	if (!wsi->a.vhost)
 		return;
 
 	/* only worry about preparing it if we store it */
-	if (wsi->vhost->log_fd == (int)LWS_INVALID_FILE)
+	if (wsi->a.vhost->log_fd == (int)LWS_INVALID_FILE)
 		return;
 
 	if (wsi->access_log_pending)
@@ -138,10 +138,10 @@ lws_access_log(struct lws *wsi)
 	     *p1 = wsi->http.access_log.referrer;
 	int l;
 
-	if (!wsi->vhost)
+	if (!wsi->a.vhost)
 		return 0;
 
-	if (wsi->vhost->log_fd == (int)LWS_INVALID_FILE)
+	if (wsi->a.vhost->log_fd == (int)LWS_INVALID_FILE)
 		return 0;
 
 	if (!wsi->access_log_pending)
@@ -173,7 +173,7 @@ lws_access_log(struct lws *wsi)
 
 	ass[sizeof(ass) - 1] = '\0';
 
-	if (write(wsi->vhost->log_fd, ass, l) != l)
+	if (write(wsi->a.vhost->log_fd, ass, l) != l)
 		lwsl_err("Failed to write log\n");
 
 	if (wsi->http.access_log.header_log) {
diff --git a/lib/roles/http/server/server.c b/lib/roles/http/server/server.c
index fab5479e7..fe3163ebc 100644
--- a/lib/roles/http/server/server.c
+++ b/lib/roles/http/server/server.c
@@ -287,16 +287,16 @@ done_list:
 			lwsl_debug("%s: lws_socket_bind says %d\n", __func__, is);
 		}
 
-		wsi->context = vhost->context;
+		wsi->a.context = vhost->context;
 		wsi->desc.sockfd = sockfd;
 		lws_role_transition(wsi, 0, LRS_UNCONNECTED, &role_ops_listen);
-		wsi->protocol = vhost->protocols;
+		wsi->a.protocol = vhost->protocols;
 		wsi->tsi = m;
 		lws_vhost_bind_wsi(vhost, wsi);
 		wsi->listener = 1;
 
-		if (wsi->context->event_loop_ops->init_vhost_listen_wsi)
-			wsi->context->event_loop_ops->init_vhost_listen_wsi(wsi);
+		if (wsi->a.context->event_loop_ops->init_vhost_listen_wsi)
+			wsi->a.context->event_loop_ops->init_vhost_listen_wsi(wsi);
 
 		if (__insert_wsi_socket_into_fds(vhost->context, wsi)) {
 			lwsl_notice("inserting wsi socket into fds failed\n");
@@ -514,12 +514,12 @@ lws_http_serve(struct lws *wsi, char *uri, const char *origin,
 	int n;
 
 	wsi->handling_404 = 0;
-	if (!wsi->vhost)
+	if (!wsi->a.vhost)
 		return -1;
 
 #if defined(LWS_ROLE_H1) || defined(LWS_ROLE_H2)
-	if (wsi->vhost->http.error_document_404 &&
-	    !strcmp(uri, wsi->vhost->http.error_document_404))
+	if (wsi->a.vhost->http.error_document_404 &&
+	    !strcmp(uri, wsi->a.vhost->http.error_document_404))
 		wsi->handling_404 = 1;
 #endif
 
@@ -531,12 +531,12 @@ lws_http_serve(struct lws *wsi, char *uri, const char *origin,
 
 	do {
 		spin++;
-		fops = lws_vfs_select_fops(wsi->context->fops, path, &vpath);
+		fops = lws_vfs_select_fops(wsi->a.context->fops, path, &vpath);
 
 		if (wsi->http.fop_fd)
 			lws_vfs_file_close(&wsi->http.fop_fd);
 
-		wsi->http.fop_fd = fops->LWS_FOP_OPEN(wsi->context->fops,
+		wsi->http.fop_fd = fops->LWS_FOP_OPEN(wsi->a.context->fops,
 							path, vpath, &fflags);
 		if (!wsi->http.fop_fd) {
 			lwsl_info("%s: Unable to open '%s': errno %d\n",
@@ -712,15 +712,15 @@ lws_http_serve(struct lws *wsi, char *uri, const char *origin,
 				wsi->sending_chunked = 1;
 
 			wsi->protocol_interpret_idx = (char)(
-				lws_vhost_name_to_protocol(wsi->vhost,
+				lws_vhost_name_to_protocol(wsi->a.vhost,
 							   pvo->value) -
 				&lws_get_vhost(wsi)->protocols[0]);
 
 			lwsl_debug("want %s interpreted by %s (pcol is %s)\n", path,
-				    wsi->vhost->protocols[
+				    wsi->a.vhost->protocols[
 				             (int)wsi->protocol_interpret_idx].name,
-				             wsi->protocol->name);
-			if (lws_bind_protocol(wsi, &wsi->vhost->protocols[
+				             wsi->a.protocol->name);
+			if (lws_bind_protocol(wsi, &wsi->a.vhost->protocols[
 			          (int)wsi->protocol_interpret_idx], __func__))
 				return -1;
 
@@ -741,7 +741,7 @@ lws_http_serve(struct lws *wsi, char *uri, const char *origin,
 
 	if (m->protocol) {
 		const struct lws_protocols *pp = lws_vhost_name_to_protocol(
-						       wsi->vhost, m->protocol);
+						       wsi->a.vhost, m->protocol);
 
 		if (lws_bind_protocol(wsi, pp, __func__))
 			return -1;
@@ -775,7 +775,7 @@ lws_find_mount(struct lws *wsi, const char *uri_ptr, int uri_len)
 	const struct lws_http_mount *hm, *hit = NULL;
 	int best = 0;
 
-	hm = wsi->vhost->http.mount_list;
+	hm = wsi->a.vhost->http.mount_list;
 	while (hm) {
 		if (uri_len >= hm->mountpoint_len &&
 		    !strncmp(uri_ptr, hm->mountpoint, hm->mountpoint_len) &&
@@ -857,7 +857,7 @@ lws_find_string_in_file(const char *filename, const char *string, int stringlen)
 int
 lws_unauthorised_basic_auth(struct lws *wsi)
 {
-	struct lws_context_per_thread *pt = &wsi->context->pt[(int)wsi->tsi];
+	struct lws_context_per_thread *pt = &wsi->a.context->pt[(int)wsi->tsi];
 	unsigned char *start = pt->serv_buf + LWS_PRE,
 		      *p = start, *end = p + 2048;
 	char buf[64];
@@ -1031,7 +1031,7 @@ lws_check_basic_auth(struct lws *wsi, const char *basic_auth_login_file,
 		return LCBA_FAILED_AUTH;
 
 	case LWSAUTHM_BASIC_AUTH_CALLBACK:
-		bar = wsi->protocol->callback(wsi,
+		bar = wsi->a.protocol->callback(wsi,
 				LWS_CALLBACK_VERIFY_BASIC_AUTHORIZATION,
 				wsi->user_space, plain, m);
 		if (!bar)
@@ -1220,7 +1220,7 @@ lws_http_proxy_start(struct lws *wsi, const struct lws_http_mount *hit,
 
 	if (i.host)
 		lws_snprintf(host, sizeof(host), "%s:%u", i.host,
-					wsi->vhost->listen_port);
+					wsi->a.vhost->listen_port);
 	else
 		lws_snprintf(host, sizeof(host), "%s:%d", i.address, i.port);
 
@@ -1318,7 +1318,7 @@ lws_http_redirect_hit(struct lws_context_per_thread *pt, struct lws *wsi,
 	    (hit->origin_protocol != LWSMPRO_CGI &&
 	     hit->origin_protocol != LWSMPRO_CALLBACK)) {
 		unsigned char *start = pt->serv_buf + LWS_PRE, *p = start,
-			      *end = p + wsi->context->pt_serv_buf_size -
+			      *end = p + wsi->a.context->pt_serv_buf_size -
 					LWS_PRE - 512;
 
 		*h = 1;
@@ -1374,7 +1374,7 @@ bail_nuke_ah:
 int
 lws_http_action(struct lws *wsi)
 {
-	struct lws_context_per_thread *pt = &wsi->context->pt[(int)wsi->tsi];
+	struct lws_context_per_thread *pt = &wsi->a.context->pt[(int)wsi->tsi];
 	int uri_len = 0, meth, m, http_version_len, ha;
 	const struct lws_http_mount *hit = NULL;
 	enum http_version request_version;
@@ -1476,7 +1476,7 @@ lws_http_action(struct lws *wsi)
 		wsi->http.conn_type = conn_type;
 	}
 
-	n = wsi->protocol->callback(wsi, LWS_CALLBACK_FILTER_HTTP_CONNECTION,
+	n = wsi->a.protocol->callback(wsi, LWS_CALLBACK_FILTER_HTTP_CONNECTION,
 				    wsi->user_space, uri_ptr, uri_len);
 	if (n) {
 		lwsl_info("LWS_CALLBACK_HTTP closing\n");
@@ -1489,7 +1489,7 @@ lws_http_action(struct lws *wsi)
 	 */
 	if (!wsi->mux_stream_immortal)
 		lws_set_timeout(wsi, PENDING_TIMEOUT_HTTP_CONTENT,
-				wsi->context->timeout_secs);
+				wsi->a.context->timeout_secs);
 #ifdef LWS_WITH_TLS
 	if (wsi->tls.redirect_to_https) {
 		/*
@@ -1498,7 +1498,7 @@ lws_http_action(struct lws *wsi)
 		 * URI from the host: header and ignore the path part
 		 */
 		unsigned char *start = pt->serv_buf + LWS_PRE, *p = start,
-			      *end = p + wsi->context->pt_serv_buf_size - LWS_PRE;
+			      *end = p + wsi->a.context->pt_serv_buf_size - LWS_PRE;
 
 		n = lws_hdr_total_length(wsi, WSI_TOKEN_HOST);
 		if (!n || n > 128)
@@ -1533,13 +1533,13 @@ lws_http_action(struct lws *wsi)
 
 		lwsl_info("no hit\n");
 
-		if (lws_bind_protocol(wsi, &wsi->vhost->protocols[0],
+		if (lws_bind_protocol(wsi, &wsi->a.vhost->protocols[0],
 				      "no mount hit"))
 			return 1;
 
 		lwsi_set_state(wsi, LRS_DOING_TRANSACTION);
 
-		m = wsi->protocol->callback(wsi, LWS_CALLBACK_HTTP,
+		m = wsi->a.protocol->callback(wsi, LWS_CALLBACK_HTTP,
 				    wsi->user_space, uri_ptr, uri_len);
 
 		goto after;
@@ -1599,7 +1599,7 @@ lws_http_action(struct lws *wsi)
 		if (hit->protocol)
 			name = hit->protocol;
 
-		pp = lws_vhost_name_to_protocol(wsi->vhost, name);
+		pp = lws_vhost_name_to_protocol(wsi->a.vhost, name);
 		if (!pp) {
 			lwsl_err("Unable to find plugin '%s'\n",
 				 hit->origin);
@@ -1618,7 +1618,7 @@ lws_http_action(struct lws *wsi)
 		args.final = 0; /* used to signal callback dealt with it */
 		args.chunked = 0;
 
-		n = wsi->protocol->callback(wsi,
+		n = wsi->a.protocol->callback(wsi,
 					    LWS_CALLBACK_CHECK_ACCESS_RIGHTS,
 					    wsi->user_space, &args, 0);
 		if (n) {
@@ -1629,13 +1629,13 @@ lws_http_action(struct lws *wsi)
 		if (args.final) /* callback completely handled it well */
 			return 0;
 
-		if (hit->cgienv && wsi->protocol->callback(wsi,
+		if (hit->cgienv && wsi->a.protocol->callback(wsi,
 				LWS_CALLBACK_HTTP_PMO,
 				wsi->user_space, (void *)hit->cgienv, 0))
 			return 1;
 
 		if (lws_hdr_total_length(wsi, WSI_TOKEN_POST_URI)) {
-			m = wsi->protocol->callback(wsi, LWS_CALLBACK_HTTP,
+			m = wsi->a.protocol->callback(wsi, LWS_CALLBACK_HTTP,
 					    wsi->user_space,
 					    uri_ptr + hit->mountpoint_len,
 					    uri_len - hit->mountpoint_len);
@@ -1694,7 +1694,7 @@ lws_http_action(struct lws *wsi)
 		if (hit->protocol) {
 			const struct lws_protocols *pp =
 					lws_vhost_name_to_protocol(
-						wsi->vhost, hit->protocol);
+						wsi->a.vhost, hit->protocol);
 
 			lwsi_set_state(wsi, LRS_DOING_TRANSACTION);
 
@@ -1706,7 +1706,7 @@ lws_http_action(struct lws *wsi)
 					 uri_ptr + hit->mountpoint_len,
 					 uri_len - hit->mountpoint_len);
 		} else
-			m = wsi->protocol->callback(wsi, LWS_CALLBACK_HTTP,
+			m = wsi->a.protocol->callback(wsi, LWS_CALLBACK_HTTP,
 				    wsi->user_space, uri_ptr, uri_len);
 	}
 
@@ -1750,10 +1750,10 @@ deal_body:
 		 * status code and result body if any, and to do the transaction
 		 * complete processing.
 		 */
-		if (wsi->protocol->callback(wsi, LWS_CALLBACK_HTTP_BODY,
+		if (wsi->a.protocol->callback(wsi, LWS_CALLBACK_HTTP_BODY,
 					    wsi->user_space, NULL, 0))
 			return 1;
-		if (wsi->protocol->callback(wsi, LWS_CALLBACK_HTTP_BODY_COMPLETION,
+		if (wsi->a.protocol->callback(wsi, LWS_CALLBACK_HTTP_BODY_COMPLETION,
 					    wsi->user_space, NULL, 0))
 			return 1;
 
@@ -1841,10 +1841,10 @@ lws_confirm_host_header(struct lws *wsi)
 	if (lws_tokenize(&ts) != LWS_TOKZE_TOKEN)
 		goto bad_format;
 
-	if (strncmp(ts.token, wsi->vhost->name, ts.token_len)) {
+	if (strncmp(ts.token, wsi->a.vhost->name, ts.token_len)) {
 		buf[(ts.token - buf) + ts.token_len] = '\0';
 		lwsl_info("%s: '%s' in host hdr but vhost name %s\n",
-			  __func__, ts.token, wsi->vhost->name);
+			  __func__, ts.token, wsi->a.vhost->name);
 		return 1;
 	}
 
@@ -1858,9 +1858,9 @@ lws_confirm_host_header(struct lws *wsi)
 		if (e != LWS_TOKZE_ENDED)
 			goto bad_format;
 
-	if (wsi->vhost->listen_port != port) {
+	if (wsi->a.vhost->listen_port != port) {
 		lwsl_info("%s: host port %d mismatches vhost port %d\n",
-			  __func__, port, wsi->vhost->listen_port);
+			  __func__, port, wsi->a.vhost->listen_port);
 		return 1;
 	}
 
@@ -1880,17 +1880,17 @@ lws_http_to_fallback(struct lws *wsi, unsigned char *obuf, size_t olen)
 {
 	const struct lws_role_ops *role = &role_ops_raw_skt;
 	const struct lws_protocols *p1, *protocol =
-			 &wsi->vhost->protocols[wsi->vhost->raw_protocol_index];
+			 &wsi->a.vhost->protocols[wsi->a.vhost->raw_protocol_index];
 	char ipbuf[64];
 	int n;
 
-	if (wsi->vhost->listen_accept_role &&
-	    lws_role_by_name(wsi->vhost->listen_accept_role))
-		role = lws_role_by_name(wsi->vhost->listen_accept_role);
+	if (wsi->a.vhost->listen_accept_role &&
+	    lws_role_by_name(wsi->a.vhost->listen_accept_role))
+		role = lws_role_by_name(wsi->a.vhost->listen_accept_role);
 
-	if (wsi->vhost->listen_accept_protocol) {
-		p1 = lws_vhost_name_to_protocol(wsi->vhost,
-			    wsi->vhost->listen_accept_protocol);
+	if (wsi->a.vhost->listen_accept_protocol) {
+		p1 = lws_vhost_name_to_protocol(wsi->a.vhost,
+			    wsi->a.vhost->listen_accept_protocol);
 		if (p1)
 			protocol = p1;
 	}
@@ -1912,16 +1912,16 @@ lws_http_to_fallback(struct lws *wsi, unsigned char *obuf, size_t olen)
 #endif
 
 	lwsl_notice("%s: vh %s, peer: %s, role %s, "
-		    "protocol %s, cb %d, ah %p\n", __func__, wsi->vhost->name,
+		    "protocol %s, cb %d, ah %p\n", __func__, wsi->a.vhost->name,
 		    ipbuf, role->name, protocol->name, n, wsi->http.ah);
 
-	if ((wsi->protocol->callback)(wsi, n, wsi->user_space, NULL, 0))
+	if ((wsi->a.protocol->callback)(wsi, n, wsi->user_space, NULL, 0))
 		return 1;
 
 	n = LWS_CALLBACK_RAW_RX;
 	if (wsi->role_ops->rx_cb[lwsi_role_server(wsi)])
 		n = wsi->role_ops->rx_cb[lwsi_role_server(wsi)];
-	if (wsi->protocol->callback(wsi, n, wsi->user_space, obuf, olen))
+	if (wsi->a.protocol->callback(wsi, n, wsi->user_space, obuf, olen))
 		return 1;
 
 	return 0;
@@ -2000,10 +2000,10 @@ raw_transition:
 
 		/* select vhost */
 
-		if (wsi->vhost->listen_port &&
+		if (wsi->a.vhost->listen_port &&
 		    lws_hdr_total_length(wsi, WSI_TOKEN_HOST)) {
 			struct lws_vhost *vhost = lws_select_vhost(
-				context, wsi->vhost->listen_port,
+				context, wsi->a.vhost->listen_port,
 				lws_hdr_simple_ptr(wsi, WSI_TOKEN_HOST));
 
 			if (vhost)
@@ -2013,11 +2013,11 @@ raw_transition:
 
 		if (!lwsi_role_h2(wsi) || !lwsi_role_server(wsi)) {
 #if defined(LWS_WITH_SERVER_STATUS)
-			wsi->vhost->conn_stats.h1_trans++;
+			wsi->a.vhost->conn_stats.h1_trans++;
 #endif
 			if (!wsi->conn_stat_done) {
 #if defined(LWS_WITH_SERVER_STATUS)
-				wsi->vhost->conn_stats.h1_conn++;
+				wsi->a.vhost->conn_stats.h1_conn++;
 #endif
 				wsi->conn_stat_done = 1;
 			}
@@ -2025,9 +2025,9 @@ raw_transition:
 
 		/* check for unwelcome guests */
 #if defined(LWS_WITH_HTTP_UNCOMMON_HEADERS)
-		if (wsi->context->reject_service_keywords) {
+		if (wsi->a.context->reject_service_keywords) {
 			const struct lws_protocol_vhost_options *rej =
-					wsi->context->reject_service_keywords;
+					wsi->a.context->reject_service_keywords;
 			char ua[384], *msg = NULL;
 
 			if (lws_hdr_copy(wsi, ua, sizeof(ua) - 1,
@@ -2058,7 +2058,7 @@ raw_transition:
 					/* wsi close will do the log */
 #endif
 #if defined(LWS_WITH_SERVER_STATUS)
-					wsi->vhost->conn_stats.rejected++;
+					wsi->a.vhost->conn_stats.rejected++;
 #endif
 					/*
 					 * We don't want anything from
@@ -2122,7 +2122,7 @@ raw_transition:
 					goto bail_nuke_ah;
 			}
 
-			n = user_callback_handle_rxflow(wsi->protocol->callback,
+			n = user_callback_handle_rxflow(wsi->a.protocol->callback,
 					wsi, LWS_CALLBACK_HTTP_CONFIRM_UPGRADE,
 					wsi->user_space, (char *)up, 0);
 
@@ -2144,7 +2144,7 @@ raw_transition:
 
 			/* callback said 0, it was allowed */
 
-			if (wsi->vhost->options &
+			if (wsi->a.vhost->options &
 			    LWS_SERVER_OPTION_VHOST_UPG_STRICT_HOST_CHECK &&
 			    lws_confirm_host_header(wsi))
 				goto bail_nuke_ah;
@@ -2152,7 +2152,7 @@ raw_transition:
 			if (!strcasecmp(up, "websocket")) {
 #if defined(LWS_ROLE_WS)
 #if defined(LWS_WITH_SERVER_STATUS)
-				wsi->vhost->conn_stats.ws_upg++;
+				wsi->a.vhost->conn_stats.ws_upg++;
 #endif
 				lwsl_info("Upgrade to ws\n");
 				goto upgrade_ws;
@@ -2161,7 +2161,7 @@ raw_transition:
 #if defined(LWS_WITH_HTTP2)
 			if (!strcasecmp(up, "h2c")) {
 #if defined(LWS_WITH_SERVER_STATUS)
-				wsi->vhost->conn_stats.h2_upg++;
+				wsi->a.vhost->conn_stats.h2_upg++;
 #endif
 				lwsl_info("Upgrade to h2c\n");
 				goto upgrade_h2c;
@@ -2364,7 +2364,7 @@ lws_http_transaction_completed(struct lws *wsi)
 		return 1;
 	}
 
-	if (lws_bind_protocol(wsi, &wsi->vhost->protocols[0], __func__))
+	if (lws_bind_protocol(wsi, &wsi->a.vhost->protocols[0], __func__))
 		return 1;
 
 	/*
@@ -2390,9 +2390,9 @@ lws_http_transaction_completed(struct lws *wsi)
 #endif
 
 	n = NO_PENDING_TIMEOUT;
-	if (wsi->vhost->keepalive_timeout)
+	if (wsi->a.vhost->keepalive_timeout)
 		n = PENDING_TIMEOUT_HTTP_KEEPALIVE_IDLE;
-	lws_set_timeout(wsi, n, wsi->vhost->keepalive_timeout);
+	lws_set_timeout(wsi, n, wsi->a.vhost->keepalive_timeout);
 
 	/*
 	 * We already know we are on http1.1 / keepalive and the next thing
@@ -2419,10 +2419,10 @@ lws_http_transaction_completed(struct lws *wsi)
 			 * SSL is scarce, drop this connection without waiting
 			 */
 
-			if (wsi->vhost->tls.use_ssl &&
-			    wsi->context->simultaneous_ssl_restriction &&
-			    wsi->context->simultaneous_ssl ==
-				   wsi->context->simultaneous_ssl_restriction) {
+			if (wsi->a.vhost->tls.use_ssl &&
+			    wsi->a.context->simultaneous_ssl_restriction &&
+			    wsi->a.context->simultaneous_ssl ==
+				   wsi->a.context->simultaneous_ssl_restriction) {
 				lwsl_info("%s: simultaneous_ssl_restriction\n",
 					  __func__);
 				return 1;
@@ -2439,7 +2439,7 @@ lws_http_transaction_completed(struct lws *wsi)
 			 * open.
 			 */
 			lws_set_timeout(wsi, PENDING_TIMEOUT_HOLDING_AH,
-					wsi->vhost->keepalive_timeout);
+					wsi->a.vhost->keepalive_timeout);
 		}
 		/* If we're (re)starting on headers, need other implied init */
 		if (wsi->http.ah)
@@ -2492,9 +2492,9 @@ lws_serve_http_file(struct lws *wsi, const char *file, const char *content_type,
 	 * If wsi->http.fop_fd is already set, the caller already opened it
 	 */
 	if (!wsi->http.fop_fd) {
-		fops = lws_vfs_select_fops(wsi->context->fops, file, &vpath);
+		fops = lws_vfs_select_fops(wsi->a.context->fops, file, &vpath);
 		fflags |= lws_vfs_prepare_flags(wsi);
-		wsi->http.fop_fd = fops->LWS_FOP_OPEN(wsi->context->fops,
+		wsi->http.fop_fd = fops->LWS_FOP_OPEN(wsi->a.context->fops,
 							file, vpath, &fflags);
 		if (!wsi->http.fop_fd) {
 			lwsl_info("%s: Unable to open: '%s': errno %d\n",
@@ -2764,7 +2764,7 @@ bail:
 
 int lws_serve_http_file_fragment(struct lws *wsi)
 {
-	struct lws_context *context = wsi->context;
+	struct lws_context *context = wsi->a.context;
 	struct lws_context_per_thread *pt = &context->pt[(int)wsi->tsi];
 	struct lws_process_html_args args;
 	lws_filepos_t amount, poss;
@@ -2861,9 +2861,9 @@ int lws_serve_http_file_fragment(struct lws *wsi)
 		 * If there is a hint about how much we will do well to send at
 		 * one time, restrict ourselves to only trying to send that.
 		 */
-		if (wsi->protocol->tx_packet_size &&
-		    poss > wsi->protocol->tx_packet_size)
-			poss = wsi->protocol->tx_packet_size;
+		if (wsi->a.protocol->tx_packet_size &&
+		    poss > wsi->a.protocol->tx_packet_size)
+			poss = wsi->a.protocol->tx_packet_size;
 
 		if (wsi->role_ops->tx_credit) {
 			lws_filepos_t txc =
@@ -2926,7 +2926,7 @@ int lws_serve_http_file_fragment(struct lws *wsi)
 					     wsi->http.filelen;
 				args.chunked = wsi->sending_chunked;
 				if (user_callback_handle_rxflow(
-				     wsi->vhost->protocols[
+				     wsi->a.vhost->protocols[
 				     (int)wsi->protocol_interpret_idx].callback,
 				     wsi, LWS_CALLBACK_PROCESS_HTML,
 				     wsi->user_space, &args, 0) < 0)
@@ -2998,8 +2998,8 @@ all_sent:
 
 			lwsl_debug("file completed\n");
 
-			if (wsi->protocol->callback &&
-			    user_callback_handle_rxflow(wsi->protocol->callback,
+			if (wsi->a.protocol->callback &&
+			    user_callback_handle_rxflow(wsi->a.protocol->callback,
 					wsi, LWS_CALLBACK_HTTP_FILE_COMPLETION,
 					wsi->user_space, NULL, 0) < 0) {
 					/*
diff --git a/lib/roles/listen/ops-listen.c b/lib/roles/listen/ops-listen.c
index 4d4fff18f..581442b1f 100644
--- a/lib/roles/listen/ops-listen.c
+++ b/lib/roles/listen/ops-listen.c
@@ -28,7 +28,7 @@ static int
 rops_handle_POLLIN_listen(struct lws_context_per_thread *pt, struct lws *wsi,
 			  struct lws_pollfd *pollfd)
 {
-	struct lws_context *context = wsi->context;
+	struct lws_context *context = wsi->a.context;
 	lws_sockfd_type accept_fd = LWS_SOCK_INVALID;
 	lws_sock_file_fd_type fd;
 	struct sockaddr_storage cli_addr;
@@ -38,7 +38,7 @@ rops_handle_POLLIN_listen(struct lws_context_per_thread *pt, struct lws *wsi,
 
 	/* if our vhost is going down, ignore it */
 
-	if (wsi->vhost->being_destroyed)
+	if (wsi->a.vhost->being_destroyed)
 		return LWS_HPI_RET_HANDLED;
 
 	/* pollin means a client has connected to us then
@@ -61,7 +61,7 @@ rops_handle_POLLIN_listen(struct lws_context_per_thread *pt, struct lws *wsi,
 		 * another vhost may also have had POLLIN on his
 		 * listener this round and used it up already
 		 */
-		if (wsi->vhost->tls.use_ssl &&
+		if (wsi->a.vhost->tls.use_ssl &&
 		    context->simultaneous_ssl_restriction &&
 		    context->simultaneous_ssl ==
 				  context->simultaneous_ssl_restriction)
@@ -99,7 +99,7 @@ rops_handle_POLLIN_listen(struct lws_context_per_thread *pt, struct lws *wsi,
 			return LWS_HPI_RET_PLEASE_CLOSE_ME;
 		}
 
-		lws_plat_set_socket_options(wsi->vhost, accept_fd, 0);
+		lws_plat_set_socket_options(wsi->a.vhost, accept_fd, 0);
 
 #if defined(LWS_WITH_IPV6)
 		lwsl_debug("accepted new conn port %u on fd=%d\n",
@@ -124,7 +124,7 @@ rops_handle_POLLIN_listen(struct lws_context_per_thread *pt, struct lws *wsi,
 		 * protocol selected yet so we issue this to
 		 * protocols[0]
 		 */
-		if ((wsi->vhost->protocols[0].callback)(wsi,
+		if ((wsi->a.vhost->protocols[0].callback)(wsi,
 				LWS_CALLBACK_FILTER_NETWORK_CONNECTION,
 				NULL,
 				(void *)(lws_intptr_t)accept_fd, 0)) {
@@ -133,21 +133,21 @@ rops_handle_POLLIN_listen(struct lws_context_per_thread *pt, struct lws *wsi,
 			return LWS_HPI_RET_HANDLED;
 		}
 
-		if (!(wsi->vhost->options &
+		if (!(wsi->a.vhost->options &
 			LWS_SERVER_OPTION_ADOPT_APPLY_LISTEN_ACCEPT_CONFIG))
 			opts |= LWS_ADOPT_HTTP;
 
 #if defined(LWS_WITH_TLS)
-		if (!wsi->vhost->tls.use_ssl)
+		if (!wsi->a.vhost->tls.use_ssl)
 #endif
 			opts &= ~LWS_ADOPT_ALLOW_SSL;
 
 		fd.sockfd = accept_fd;
-		cwsi = lws_adopt_descriptor_vhost(wsi->vhost, opts, fd,
-				wsi->vhost->listen_accept_protocol, NULL);
+		cwsi = lws_adopt_descriptor_vhost(wsi->a.vhost, opts, fd,
+				wsi->a.vhost->listen_accept_protocol, NULL);
 		if (!cwsi) {
 			lwsl_info("%s: vh %s: adopt failed\n", __func__,
-					wsi->vhost->name);
+					wsi->a.vhost->name);
 
 			/* already closed cleanly as necessary */
 			return LWS_HPI_RET_WSI_ALREADY_DIED;
diff --git a/lib/roles/mqtt/client/client-mqtt.c b/lib/roles/mqtt/client/client-mqtt.c
index 3f6fcecdf..a871bfefc 100644
--- a/lib/roles/mqtt/client/client-mqtt.c
+++ b/lib/roles/mqtt/client/client-mqtt.c
@@ -44,7 +44,7 @@ static const uint8_t *code = (const uint8_t *)
 static int
 lws_mqtt_generate_id(struct lws* wsi, lws_mqtt_str_t **ms, const char *client_id)
 {
-	struct lws_context *context = wsi->context;
+	struct lws_context *context = wsi->a.context;
 	uint16_t ran[24]; /* 16-bit so wrap bias from %62 diluted by ~1000 */
 	size_t n, len;
 	uint8_t *buf;
@@ -171,7 +171,7 @@ int
 lws_mqtt_client_socket_service(struct lws *wsi, struct lws_pollfd *pollfd,
 			  struct lws *wsi_conn)
 {
-	struct lws_context *context = wsi->context;
+	struct lws_context *context = wsi->a.context;
 	struct lws_context_per_thread *pt = &context->pt[(int)wsi->tsi];
 	int n = 0, m = 0;
 	struct lws_tokens ebuf;
@@ -266,7 +266,7 @@ lws_mqtt_client_socket_service(struct lws *wsi, struct lws_pollfd *pollfd,
 				lws_now_usecs() -
 				wsi->detlat.earliest_write_req_pre_write;
 			wsi->detlat.latencies[LAT_DUR_USERCB] = 0;
-			lws_det_lat_cb(wsi->context, &wsi->detlat);
+			lws_det_lat_cb(wsi->a.context, &wsi->detlat);
 		}
 #endif
 #if 0
@@ -325,10 +325,10 @@ start_ws_handshake:
 	case LRS_MQTTC_AWAIT_CONNACK:
 		buffered = 0;
 		ebuf.token = pt->serv_buf;
-		ebuf.len = wsi->context->pt_serv_buf_size;
+		ebuf.len = wsi->a.context->pt_serv_buf_size;
 
-		if ((unsigned int)ebuf.len > wsi->context->pt_serv_buf_size)
-			ebuf.len = wsi->context->pt_serv_buf_size;
+		if ((unsigned int)ebuf.len > wsi->a.context->pt_serv_buf_size)
+			ebuf.len = wsi->a.context->pt_serv_buf_size;
 
 		if ((int)pending > ebuf.len)
 			pending = ebuf.len;
diff --git a/lib/roles/mqtt/mqtt.c b/lib/roles/mqtt/mqtt.c
index 0fa50919e..fb37828d4 100644
--- a/lib/roles/mqtt/mqtt.c
+++ b/lib/roles/mqtt/mqtt.c
@@ -258,7 +258,7 @@ lws_mqtt_set_client_established(struct lws *wsi)
 	lws_role_transition(wsi, LWSIFR_CLIENT, LRS_ESTABLISHED,
 			    &role_ops_mqtt);
 
-	if (user_callback_handle_rxflow(wsi->protocol->callback,
+	if (user_callback_handle_rxflow(wsi->a.protocol->callback,
 					wsi, LWS_CALLBACK_MQTT_CLIENT_ESTABLISHED,
 					wsi->user_space, NULL, 0) < 0) {
 		lwsl_err("%s: MQTT_ESTABLISHED failed\n", __func__);
@@ -990,7 +990,7 @@ cmd_completion:
 				/* we were under SENT_CLIENT_HANDSHAKE timeout */
 				lws_set_timeout(wsi, 0, 0);
 
-				w = lws_create_new_server_wsi(wsi->vhost,
+				w = lws_create_new_server_wsi(wsi->a.vhost,
 							      wsi->tsi);
 				if (!w) {
 					lwsl_notice("%s: sid 1 migrate failed\n",
@@ -1020,7 +1020,7 @@ cmd_completion:
 				if (!wsi->mqtt)
 					return -1;
 				w->mqtt->wsi = w;
-				w->protocol = wsi->protocol;
+				w->a.protocol = wsi->a.protocol;
 				if (w->user_space &&
 				    !w->user_space_externally_allocated)
 					lws_free_set_NULL(w->user_space);
@@ -1030,8 +1030,8 @@ cmd_completion:
 					wsi->user_space_externally_allocated;
 				if (lws_ensure_user_space(w))
 					goto bail1;
-				w->opaque_user_data = wsi->opaque_user_data;
-				wsi->opaque_user_data = NULL;
+				w->a.opaque_user_data = wsi->a.opaque_user_data;
+				wsi->a.opaque_user_data = NULL;
 				w->stash = wsi->stash;
 				wsi->stash = NULL;
 
@@ -1041,7 +1041,7 @@ cmd_completion:
 						__func__, wsi, w);
 
 			#if defined(LWS_WITH_SERVER_STATUS)
-				wsi->vhost->conn_stats.h2_subs++;
+				wsi->a.vhost->conn_stats.h2_subs++;
 			#endif
 
 				/*
@@ -1065,11 +1065,11 @@ bail1:
 				wsi->mux.child_list = w->mux.sibling_list;
 				wsi->mux.child_count--;
 
-				w->context->count_wsi_allocated--;
+				w->a.context->count_wsi_allocated--;
 
 				if (w->user_space)
 					lws_free_set_NULL(w->user_space);
-				w->vhost->protocols[0].callback(w,
+				w->a.vhost->protocols[0].callback(w,
 							LWS_CALLBACK_WSI_DESTROY,
 							NULL, NULL, 0);
 				lws_vhost_unbind_wsi(w);
@@ -1094,7 +1094,7 @@ bail1:
 
 						w->mqtt->unacked_publish = 0;
 						if (user_callback_handle_rxflow(
-							    w->protocol->callback,
+							    w->a.protocol->callback,
 							    w, LWS_CALLBACK_MQTT_ACK,
 							    w->user_space, NULL, 0) < 0) {
 							lwsl_info("%s: MQTT_ACK requests close\n",
@@ -1160,7 +1160,7 @@ bail1:
 					    w->mqtt->ack_pkt_id == par->cpkt_id) {
 						w->mqtt->inside_subscribe = 0;
 						if (user_callback_handle_rxflow(
-							    w->protocol->callback,
+							    w->a.protocol->callback,
 							    w, LWS_CALLBACK_MQTT_SUBSCRIBED,
 							    w->user_space, NULL, 0) < 0) {
 							lwsl_err("%s: MQTT_SUBSCRIBE failed\n",
@@ -1210,7 +1210,7 @@ bail1:
 
 						w->mqtt->inside_unsubscribe = 0;
 						if (user_callback_handle_rxflow(
-							    w->protocol->callback,
+							    w->a.protocol->callback,
 							    w, LWS_CALLBACK_MQTT_UNSUBSCRIBED,
 							    w->user_space, NULL, 0) < 0) {
 							lwsl_info("%s: MQTT_UNSUBACK requests close\n",
@@ -1272,7 +1272,7 @@ bail1:
 						      wsi->mux.child_list) {
 					if (lws_mqtt_find_sub(w->mqtt,
 							      pub->topic))
-						if (w->protocol->callback(
+						if (w->a.protocol->callback(
 							    w, n,
 							    w->user_space,
 							    (void *)pub,
@@ -1582,7 +1582,7 @@ lws_mqtt_publish_resend(struct lws_sorted_usec_list *sul)
 
 	lwsl_notice("%s: wsi %p\n", __func__, mqtt->wsi);
 
-	if (mqtt->wsi->protocol->callback(mqtt->wsi, LWS_CALLBACK_MQTT_RESEND,
+	if (mqtt->wsi->a.protocol->callback(mqtt->wsi, LWS_CALLBACK_MQTT_RESEND,
 				mqtt->wsi->user_space, NULL, 0))
 		lws_set_timeout(mqtt->wsi, 1, LWS_TO_KILL_ASYNC);
 }
@@ -1591,7 +1591,7 @@ int
 lws_mqtt_client_send_publish(struct lws *wsi, lws_mqtt_publish_param_t *pub,
 			     const void *buf, uint32_t len, int is_complete)
 {
-	struct lws_context_per_thread *pt = &wsi->context->pt[(int)wsi->tsi];
+	struct lws_context_per_thread *pt = &wsi->a.context->pt[(int)wsi->tsi];
 	uint8_t *b = (uint8_t *)pt->serv_buf, *start, *p;
 	struct lws *nwsi = lws_get_network_wsi(wsi);
 	lws_mqtt_str_t mqtt_vh_payload;
@@ -1644,7 +1644,7 @@ lws_mqtt_client_send_publish(struct lws *wsi, lws_mqtt_publish_param_t *pub,
 
 	/* Will the chunk of payload fit? */
 	if ((vh_len + len) >=
-	    (wsi->context->pt_serv_buf_size - LWS_PRE)) {
+	    (wsi->a.context->pt_serv_buf_size - LWS_PRE)) {
 		lwsl_err("%s: Payload is too big\n", __func__);
 		return 1;
 	}
@@ -1728,7 +1728,7 @@ do_write:
 		 * so the user callback logic is the same for QoS0 or
 		 * QoS1
 		 */
-		if (wsi->protocol->callback(wsi, LWS_CALLBACK_MQTT_ACK,
+		if (wsi->a.protocol->callback(wsi, LWS_CALLBACK_MQTT_ACK,
 					    wsi->user_space, NULL, 0)) {
 			lwsl_err("%s: ACK callback exited\n", __func__);
 			return 1;
@@ -1750,7 +1750,7 @@ do_write:
 int
 lws_mqtt_client_send_subcribe(struct lws *wsi, lws_mqtt_subscribe_param_t *sub)
 {
-	struct lws_context_per_thread *pt = &wsi->context->pt[(int)wsi->tsi];
+	struct lws_context_per_thread *pt = &wsi->a.context->pt[(int)wsi->tsi];
 	uint8_t *b = (uint8_t *)pt->serv_buf + LWS_PRE, *start = b, *p = start;
 	struct lws *nwsi = lws_get_network_wsi(wsi);
 	lws_mqtt_str_t mqtt_vh_payload;
@@ -1814,7 +1814,7 @@ lws_mqtt_client_send_subcribe(struct lws *wsi, lws_mqtt_subscribe_param_t *sub)
 			 */
 			lwsl_notice("%s: all topics already subscribed\n", __func__);
 			if (user_callback_handle_rxflow(
-				    wsi->protocol->callback,
+				    wsi->a.protocol->callback,
 				    wsi, LWS_CALLBACK_MQTT_SUBSCRIBED,
 				    wsi->user_space, NULL, 0) < 0) {
 				lwsl_err("%s: MQTT_SUBSCRIBE failed\n",
@@ -1853,7 +1853,7 @@ lws_mqtt_client_send_subcribe(struct lws *wsi, lws_mqtt_subscribe_param_t *sub)
 		p += lws_mqtt_vbi_encode(rem_len, p);
 
 		if ((rem_len + lws_ptr_diff(p, start)) >=
-					       wsi->context->pt_serv_buf_size) {
+					       wsi->a.context->pt_serv_buf_size) {
 			lwsl_err("%s: Payload is too big\n", __func__);
 			return 1;
 		}
@@ -1931,7 +1931,7 @@ int
 lws_mqtt_client_send_unsubcribe(struct lws *wsi,
 				const lws_mqtt_subscribe_param_t *unsub)
 {
-	struct lws_context_per_thread *pt = &wsi->context->pt[(int)wsi->tsi];
+	struct lws_context_per_thread *pt = &wsi->a.context->pt[(int)wsi->tsi];
 	uint8_t *b = (uint8_t *)pt->serv_buf + LWS_PRE, *start = b, *p = start;
 	struct lws *nwsi = lws_get_network_wsi(wsi);
 	lws_mqtt_str_t mqtt_vh_payload;
@@ -1970,7 +1970,7 @@ lws_mqtt_client_send_unsubcribe(struct lws *wsi,
 			 */
 			lwsl_notice("%s: unsubscribed!\n", __func__);
 			if (user_callback_handle_rxflow(
-				    wsi->protocol->callback,
+				    wsi->a.protocol->callback,
 				    wsi, LWS_CALLBACK_MQTT_UNSUBSCRIBED,
 				    wsi->user_space, NULL, 0) < 0) {
 				/*
@@ -2016,7 +2016,7 @@ lws_mqtt_client_send_unsubcribe(struct lws *wsi,
 		p += lws_mqtt_vbi_encode(rem_len, p);
 
 		if ((rem_len + lws_ptr_diff(p, start)) >=
-					       wsi->context->pt_serv_buf_size) {
+					       wsi->a.context->pt_serv_buf_size) {
 			lwsl_err("%s: Payload is too big\n", __func__);
 			return 1;
 		}
@@ -2104,7 +2104,7 @@ lws_wsi_mqtt_adopt(struct lws *parent_wsi, struct lws *wsi)
 	lws_callback_on_writable(wsi);
 
 #if defined(LWS_WITH_SERVER_STATUS)
-	wsi->vhost->conn_stats.mqtt_subs++;
+	wsi->a.vhost->conn_stats.mqtt_subs++;
 #endif
 
 	return wsi;
@@ -2117,7 +2117,7 @@ bail1:
 	if (wsi->user_space)
 		lws_free_set_NULL(wsi->user_space);
 
-	wsi->protocol->callback(wsi, LWS_CALLBACK_WSI_DESTROY, NULL, NULL, 0);
+	wsi->a.protocol->callback(wsi, LWS_CALLBACK_WSI_DESTROY, NULL, NULL, 0);
 	lws_free(wsi);
 
 	return NULL;
diff --git a/lib/roles/mqtt/ops-mqtt.c b/lib/roles/mqtt/ops-mqtt.c
index 22775ad38..ea4c56c99 100644
--- a/lib/roles/mqtt/ops-mqtt.c
+++ b/lib/roles/mqtt/ops-mqtt.c
@@ -34,7 +34,7 @@ rops_handle_POLLIN_mqtt(struct lws_context_per_thread *pt, struct lws *wsi,
 	char buffered = 0;
 
 	lwsl_debug("%s: wsistate 0x%x, %s pollout %d\n", __func__,
-		   (unsigned int)wsi->wsistate,  wsi->protocol->name,
+		   (unsigned int)wsi->wsistate,  wsi->a.protocol->name,
 		   pollfd->revents);
 
 	/*
@@ -119,10 +119,10 @@ read:
 
 		buffered = 0;
 		ebuf.token = pt->serv_buf;
-		ebuf.len = wsi->context->pt_serv_buf_size;
+		ebuf.len = wsi->a.context->pt_serv_buf_size;
 
-		if ((unsigned int)ebuf.len > wsi->context->pt_serv_buf_size)
-			ebuf.len = wsi->context->pt_serv_buf_size;
+		if ((unsigned int)ebuf.len > wsi->a.context->pt_serv_buf_size)
+			ebuf.len = wsi->a.context->pt_serv_buf_size;
 
 		if ((int)pending > ebuf.len)
 			pending = ebuf.len;
@@ -175,8 +175,8 @@ drain:
 
 	pending = lws_ssl_pending(wsi);
 	if (pending) {
-		pending = pending > wsi->context->pt_serv_buf_size ?
-			wsi->context->pt_serv_buf_size : pending;
+		pending = pending > wsi->a.context->pt_serv_buf_size ?
+			wsi->a.context->pt_serv_buf_size : pending;
 		goto read;
 	}
 
@@ -215,11 +215,11 @@ rops_adoption_bind_mqtt(struct lws *wsi, int type, const char *vh_prot_name)
 				LRS_ESTABLISHED, &role_ops_mqtt);
 
 	if (vh_prot_name)
-		lws_bind_protocol(wsi, wsi->protocol, __func__);
+		lws_bind_protocol(wsi, wsi->a.protocol, __func__);
 	else
 		/* this is the only time he will transition */
 		lws_bind_protocol(wsi,
-			&wsi->vhost->protocols[wsi->vhost->mqtt_protocol_index],
+			&wsi->a.vhost->protocols[wsi->a.vhost->mqtt_protocol_index],
 			__func__);
 
 	return 1; /* bound */
diff --git a/lib/roles/raw-file/ops-raw-file.c b/lib/roles/raw-file/ops-raw-file.c
index cb7160d05..c793eb453 100644
--- a/lib/roles/raw-file/ops-raw-file.c
+++ b/lib/roles/raw-file/ops-raw-file.c
@@ -41,7 +41,7 @@ rops_handle_POLLIN_raw_file(struct lws_context_per_thread *pt, struct lws *wsi,
 	}
 
 	if (pollfd->revents & LWS_POLLIN) {
-		if (user_callback_handle_rxflow(wsi->protocol->callback,
+		if (user_callback_handle_rxflow(wsi->a.protocol->callback,
 						wsi, LWS_CALLBACK_RAW_RX_FILE,
 						wsi->user_space, NULL, 0)) {
 			lwsl_debug("raw rx callback closed it\n");
@@ -67,12 +67,12 @@ rops_adoption_bind_raw_file(struct lws *wsi, int type, const char *vh_prot_name)
 	lws_role_transition(wsi, 0, LRS_ESTABLISHED, &role_ops_raw_file);
 
 	if (!vh_prot_name) {
-		if (wsi->vhost->default_protocol_index >=
-		    wsi->vhost->count_protocols)
+		if (wsi->a.vhost->default_protocol_index >=
+		    wsi->a.vhost->count_protocols)
 			return 0;
 
-		wsi->protocol = &wsi->vhost->protocols[
-					wsi->vhost->default_protocol_index];
+		wsi->a.protocol = &wsi->a.vhost->protocols[
+					wsi->a.vhost->default_protocol_index];
 	}
 
 	return 1; /* bound */
diff --git a/lib/roles/raw-proxy/ops-raw-proxy.c b/lib/roles/raw-proxy/ops-raw-proxy.c
index c99346546..31e5e95af 100644
--- a/lib/roles/raw-proxy/ops-raw-proxy.c
+++ b/lib/roles/raw-proxy/ops-raw-proxy.c
@@ -80,7 +80,7 @@ rops_handle_POLLIN_raw_proxy(struct lws_context_per_thread *pt, struct lws *wsi,
 		case LWS_SSL_CAPABLE_MORE_SERVICE:
 			goto try_pollout;
 		}
-		n = user_callback_handle_rxflow(wsi->protocol->callback,
+		n = user_callback_handle_rxflow(wsi->a.protocol->callback,
 						wsi, lwsi_role_client(wsi) ?
 						 LWS_CALLBACK_RAW_PROXY_CLI_RX :
 						 LWS_CALLBACK_RAW_PROXY_SRV_RX,
@@ -145,11 +145,11 @@ rops_adoption_bind_raw_proxy(struct lws *wsi, int type,
 			    &role_ops_raw_proxy);
 
 	if (vh_prot_name)
-		lws_bind_protocol(wsi, wsi->protocol, __func__);
+		lws_bind_protocol(wsi, wsi->a.protocol, __func__);
 	else
 		/* this is the only time he will transition */
 		lws_bind_protocol(wsi,
-			&wsi->vhost->protocols[wsi->vhost->raw_protocol_index],
+			&wsi->a.vhost->protocols[wsi->a.vhost->raw_protocol_index],
 			__func__);
 
 	return 1; /* bound */
diff --git a/lib/roles/raw-skt/ops-raw-skt.c b/lib/roles/raw-skt/ops-raw-skt.c
index 423063dd0..fc5ff6a70 100644
--- a/lib/roles/raw-skt/ops-raw-skt.c
+++ b/lib/roles/raw-skt/ops-raw-skt.c
@@ -140,15 +140,15 @@ rops_handle_POLLIN_raw_skt(struct lws_context_per_thread *pt, struct lws *wsi,
 			}
 
 #if defined(LWS_WITH_UDP)
-			if (wsi->context->udp_loss_sim_rx_pc) {
+			if (wsi->a.context->udp_loss_sim_rx_pc) {
 				uint16_t u16;
 				/*
 				 * We should randomly drop some of these
 				 */
 
-				if (lws_get_random(wsi->context, &u16, 2) == 2 &&
+				if (lws_get_random(wsi->a.context, &u16, 2) == 2 &&
 				    ((u16 * 100) / 0xffff) <=
-					    wsi->context->udp_loss_sim_rx_pc) {
+					    wsi->a.context->udp_loss_sim_rx_pc) {
 					lwsl_warn("%s: dropping udp rx\n", __func__);
 					/* pretend it was handled */
 					n = ebuf.len;
@@ -157,7 +157,7 @@ rops_handle_POLLIN_raw_skt(struct lws_context_per_thread *pt, struct lws *wsi,
 			}
 #endif
 
-			n = user_callback_handle_rxflow(wsi->protocol->callback,
+			n = user_callback_handle_rxflow(wsi->a.protocol->callback,
 							wsi, LWS_CALLBACK_RAW_RX,
 							wsi->user_space, ebuf.token,
 							ebuf.len);
@@ -214,7 +214,7 @@ try_pollout:
 		wsi->active_writable_req_us = 0;
 	}
 #endif
-	n = user_callback_handle_rxflow(wsi->protocol->callback,
+	n = user_callback_handle_rxflow(wsi->a.protocol->callback,
 			wsi, LWS_CALLBACK_RAW_WRITEABLE,
 			wsi->user_space, NULL, 0);
 	if (n < 0) {
@@ -251,11 +251,11 @@ rops_adoption_bind_raw_skt(struct lws *wsi, int type, const char *vh_prot_name)
 				LRS_ESTABLISHED, &role_ops_raw_skt);
 
 	if (vh_prot_name)
-		lws_bind_protocol(wsi, wsi->protocol, __func__);
+		lws_bind_protocol(wsi, wsi->a.protocol, __func__);
 	else
 		/* this is the only time he will transition */
 		lws_bind_protocol(wsi,
-			&wsi->vhost->protocols[wsi->vhost->raw_protocol_index],
+			&wsi->a.vhost->protocols[wsi->a.vhost->raw_protocol_index],
 			__func__);
 
 	return 1; /* bound */
diff --git a/lib/roles/ws/client-parser-ws.c b/lib/roles/ws/client-parser-ws.c
index ce8904d1f..cacadd298 100644
--- a/lib/roles/ws/client-parser-ws.c
+++ b/lib/roles/ws/client-parser-ws.c
@@ -82,7 +82,7 @@ int lws_ws_client_rx_sm(struct lws *wsi, unsigned char c)
 #endif
 				wsi->ws->continuation_possible = 1;
 				wsi->ws->check_utf8 = lws_check_opt(
-					wsi->context->options,
+					wsi->a.context->options,
 					LWS_SERVER_OPTION_VALIDATE_UTF8);
 				wsi->ws->utf8 = 0;
 				wsi->ws->first_fragment = 1;
@@ -362,12 +362,12 @@ int lws_ws_client_rx_sm(struct lws *wsi, unsigned char c)
 		 * if there's no protocol max frame size given, we are
 		 * supposed to default to context->pt_serv_buf_size
 		 */
-		if (!wsi->protocol->rx_buffer_size &&
-		    wsi->ws->rx_ubuf_head != wsi->context->pt_serv_buf_size)
+		if (!wsi->a.protocol->rx_buffer_size &&
+		    wsi->ws->rx_ubuf_head != wsi->a.context->pt_serv_buf_size)
 			break;
 
-		if (wsi->protocol->rx_buffer_size &&
-		    wsi->ws->rx_ubuf_head != wsi->protocol->rx_buffer_size)
+		if (wsi->a.protocol->rx_buffer_size &&
+		    wsi->ws->rx_ubuf_head != wsi->a.protocol->rx_buffer_size)
 			break;
 
 		/* spill because we filled our rx buffer */
@@ -386,7 +386,7 @@ spill:
 		switch (wsi->ws->opcode) {
 		case LWSWSOPC_CLOSE:
 			pp = &wsi->ws->rx_ubuf[LWS_PRE];
-			if (lws_check_opt(wsi->context->options,
+			if (lws_check_opt(wsi->a.context->options,
 					  LWS_SERVER_OPTION_VALIDATE_UTF8) &&
 			    wsi->ws->rx_ubuf_head > 2 &&
 			    lws_check_utf8(&wsi->ws->utf8, pp + 2,
@@ -422,7 +422,7 @@ spill:
 				}
 			}
 			if (user_callback_handle_rxflow(
-					wsi->protocol->callback, wsi,
+					wsi->a.protocol->callback, wsi,
 					LWS_CALLBACK_WS_PEER_INITIATED_CLOSE,
 					wsi->user_space, pp,
 					wsi->ws->rx_ubuf_head))
@@ -619,7 +619,7 @@ utf8_fail:
 
 			pmdrx.eb_out.token[pmdrx.eb_out.len] = '\0';
 
-			if (!wsi->protocol->callback)
+			if (!wsi->a.protocol->callback)
 				goto already_done;
 
 			if (callback_action == LWS_CALLBACK_CLIENT_RECEIVE_PONG)
@@ -651,7 +651,7 @@ utf8_fail:
 			)
 				pmdrx.eb_in.len -= pmdrx.eb_out.len;
 
-			m = wsi->protocol->callback(wsi,
+			m = wsi->a.protocol->callback(wsi,
 					(enum lws_callback_reasons)callback_action,
 					wsi->user_space, pmdrx.eb_out.token,
 					pmdrx.eb_out.len);
diff --git a/lib/roles/ws/client-ws.c b/lib/roles/ws/client-ws.c
index 9a8c609af..6cd38ea4e 100644
--- a/lib/roles/ws/client-ws.c
+++ b/lib/roles/ws/client-ws.c
@@ -156,7 +156,7 @@ lws_generate_client_ws_handshake(struct lws *wsi, char *p, const char *conn1)
 	/*
 	 * create the random key
 	 */
-	if (lws_get_random(wsi->context, hash, 16) != 16) {
+	if (lws_get_random(wsi->a.context, hash, 16) != 16) {
 		lwsl_err("Unable to read from random dev %s\n",
 			 SYSTEM_RANDOM_FILEPATH);
 		return NULL;
@@ -179,10 +179,10 @@ lws_generate_client_ws_handshake(struct lws *wsi, char *p, const char *conn1)
 	/* tell the server what extensions we could support */
 
 #if !defined(LWS_WITHOUT_EXTENSIONS)
-	ext = wsi->vhost->ws.extensions;
+	ext = wsi->a.vhost->ws.extensions;
 	while (ext && ext->callback) {
 
-		n = wsi->vhost->protocols[0].callback(wsi,
+		n = wsi->a.vhost->protocols[0].callback(wsi,
 			LWS_CALLBACK_CLIENT_CONFIRM_EXTENSION_SUPPORTED,
 				wsi->user_space, (char *)ext->name, 0);
 
@@ -234,14 +234,14 @@ lws_generate_client_ws_handshake(struct lws *wsi, char *p, const char *conn1)
 int
 lws_client_ws_upgrade(struct lws *wsi, const char **cce)
 {
-	struct lws_context *context = wsi->context;
+	struct lws_context *context = wsi->a.context;
 	struct lws_tokenize ts;
 	int n, len, okay = 0;
 	lws_tokenize_elem e;
 	char *p, buf[64];
 	const char *pc;
 #if !defined(LWS_WITHOUT_EXTENSIONS)
-	struct lws_context_per_thread *pt = &wsi->context->pt[(int)wsi->tsi];
+	struct lws_context_per_thread *pt = &wsi->a.context->pt[(int)wsi->tsi];
 	char *sb = (char *)&pt->serv_buf[0];
 	const struct lws_ext_options *opts;
 	const struct lws_extension *ext;
@@ -349,15 +349,15 @@ bad_conn_format:
 		 * default to first protocol
 		 */
 
-		if (wsi->protocol) {
-			p = (char *)wsi->protocol->name;
+		if (wsi->a.protocol) {
+			p = (char *)wsi->a.protocol->name;
 			goto identify_protocol;
 		}
 
 		/* no choice but to use the default protocol */
 
 		n = 0;
-		wsi->protocol = &wsi->vhost->protocols[0];
+		wsi->a.protocol = &wsi->a.vhost->protocols[0];
 		goto check_extensions;
 	}
 
@@ -395,18 +395,18 @@ identify_protocol:
 	n = 0;
 	/* keep client connection pre-bound protocol */
 	if (!lwsi_role_client(wsi))
-		wsi->protocol = NULL;
+		wsi->a.protocol = NULL;
 
-	while (n < wsi->vhost->count_protocols) {
-		if (!wsi->protocol &&
-		    strcmp(p, wsi->vhost->protocols[n].name) == 0) {
-			wsi->protocol = &wsi->vhost->protocols[n];
+	while (n < wsi->a.vhost->count_protocols) {
+		if (!wsi->a.protocol &&
+		    strcmp(p, wsi->a.vhost->protocols[n].name) == 0) {
+			wsi->a.protocol = &wsi->a.vhost->protocols[n];
 			break;
 		}
 		n++;
 	}
 
-	if (n == wsi->vhost->count_protocols) { /* no match */
+	if (n == wsi->a.vhost->count_protocols) { /* no match */
 		/* if server, that's already fatal */
 		if (!lwsi_role_client(wsi)) {
 			lwsl_info("%s: fail protocol %s\n", __func__, p);
@@ -417,19 +417,19 @@ identify_protocol:
 		/* for client, find the index of our pre-bound protocol */
 
 		n = 0;
-		while (wsi->vhost->protocols[n].callback) {
-			if (wsi->protocol && strcmp(wsi->protocol->name,
-				   wsi->vhost->protocols[n].name) == 0) {
-				wsi->protocol = &wsi->vhost->protocols[n];
+		while (wsi->a.vhost->protocols[n].callback) {
+			if (wsi->a.protocol && strcmp(wsi->a.protocol->name,
+				   wsi->a.vhost->protocols[n].name) == 0) {
+				wsi->a.protocol = &wsi->a.vhost->protocols[n];
 				break;
 			}
 			n++;
 		}
 
-		if (!wsi->vhost->protocols[n].callback) {
-			if (wsi->protocol)
+		if (!wsi->a.vhost->protocols[n].callback) {
+			if (wsi->a.protocol)
 				lwsl_err("Failed to match protocol %s\n",
-						wsi->protocol->name);
+						wsi->a.protocol->name);
 			else
 				lwsl_err("No protocol on client\n");
 			*cce = "ws protocol no match";
@@ -437,7 +437,7 @@ identify_protocol:
 		}
 	}
 
-	lwsl_debug("Selected protocol %s\n", wsi->protocol->name);
+	lwsl_debug("Selected protocol %s\n", wsi->a.protocol->name);
 
 check_extensions:
 	/*
@@ -507,7 +507,7 @@ check_extensions:
 		lwsl_notice("checking client ext %s\n", ext_name);
 
 		n = 0;
-		ext = wsi->vhost->ws.extensions;
+		ext = wsi->a.vhost->ws.extensions;
 		while (ext && ext->callback) {
 			if (strcmp(ext_name, ext->name)) {
 				ext++;
@@ -539,7 +539,7 @@ check_extensions:
 			 * wants to
 			 */
 			ext_name[0] = '\0';
-			if (user_callback_handle_rxflow(wsi->protocol->callback,
+			if (user_callback_handle_rxflow(wsi->a.protocol->callback,
 					wsi, LWS_CALLBACK_WS_EXT_DEFAULTS,
 					(char *)ext->name, ext_name,
 					sizeof(ext_name))) {
@@ -623,7 +623,7 @@ check_accept:
 	 * we seem to be good to go, give client last chance to check
 	 * headers and OK it
 	 */
-	if (wsi->protocol->callback(wsi,
+	if (wsi->a.protocol->callback(wsi,
 				    LWS_CALLBACK_CLIENT_FILTER_PRE_ESTABLISH,
 				    wsi->user_space, NULL, 0)) {
 		*cce = "HS: Rejected by filter cb";
@@ -646,7 +646,7 @@ check_accept:
 	 * size mentioned in the protocol definition.  If 0 there, then
 	 * use a big default for compatibility
 	 */
-	n = (int)wsi->protocol->rx_buffer_size;
+	n = (int)wsi->a.protocol->rx_buffer_size;
 	if (!n)
 		n = context->pt_serv_buf_size;
 	n += LWS_PRE;
@@ -659,11 +659,11 @@ check_accept:
 	}
 	wsi->ws->rx_ubuf_alloc = n;
 
-	lwsl_debug("handshake OK for protocol %s\n", wsi->protocol->name);
+	lwsl_debug("handshake OK for protocol %s\n", wsi->a.protocol->name);
 
 	/* call him back to inform him he is up */
 
-	if (wsi->protocol->callback(wsi, LWS_CALLBACK_CLIENT_ESTABLISHED,
+	if (wsi->a.protocol->callback(wsi, LWS_CALLBACK_CLIENT_ESTABLISHED,
 				    wsi->user_space, NULL, 0)) {
 		*cce = "HS: Rejected at CLIENT_ESTABLISHED";
 		goto bail3;
diff --git a/lib/roles/ws/ext/extension-permessage-deflate.c b/lib/roles/ws/ext/extension-permessage-deflate.c
index ac3f8ca73..58fc7fa7a 100644
--- a/lib/roles/ws/ext/extension-permessage-deflate.c
+++ b/lib/roles/ws/ext/extension-permessage-deflate.c
@@ -52,9 +52,9 @@ lws_extension_pmdeflate_restrict_args(struct lws *wsi,
 
 	/* cap the RX buf at the nearest power of 2 to protocol rx buf */
 
-	n = wsi->context->pt_serv_buf_size;
-	if (wsi->protocol->rx_buffer_size)
-		n = (int)wsi->protocol->rx_buffer_size;
+	n = wsi->a.context->pt_serv_buf_size;
+	if (wsi->a.protocol->rx_buffer_size)
+		n = (int)wsi->a.protocol->rx_buffer_size;
 
 	extra = 7;
 	while (n >= 1 << (extra + 1))
@@ -130,13 +130,13 @@ lws_extension_callback_pm_deflate(struct lws_context *context,
 	case LWS_EXT_CB_CONSTRUCT:
 
 		n = context->pt_serv_buf_size;
-		if (wsi->protocol->rx_buffer_size)
-			n = (int)wsi->protocol->rx_buffer_size;
+		if (wsi->a.protocol->rx_buffer_size)
+			n = (int)wsi->a.protocol->rx_buffer_size;
 
 		if (n < 128) {
 			lwsl_info(" permessage-deflate requires the protocol "
 				  "(%s) to have an RX buffer >= 128\n",
-				  wsi->protocol->name);
+				  wsi->a.protocol->name);
 			return -1;
 		}
 
@@ -379,7 +379,7 @@ lws_extension_callback_pm_deflate(struct lws_context *context,
 			n = deflateInit2(&priv->tx, priv->args[PMD_COMP_LEVEL],
 					 Z_DEFLATED,
 					 -priv->args[PMD_SERVER_MAX_WINDOW_BITS +
-						(wsi->vhost->listen_port <= 0)],
+						(wsi->a.vhost->listen_port <= 0)],
 					 priv->args[PMD_MEM_LEVEL],
 					 Z_DEFAULT_STRATEGY);
 			if (n != Z_OK) {
diff --git a/lib/roles/ws/ext/extension.c b/lib/roles/ws/ext/extension.c
index f6ea2e3e4..9ec95eb6d 100644
--- a/lib/roles/ws/ext/extension.c
+++ b/lib/roles/ws/ext/extension.c
@@ -220,10 +220,10 @@ int lws_ext_cb_all_exts(struct lws_context *context, struct lws *wsi,
 	int n = 0, m, handled = 0;
 	const struct lws_extension *ext;
 
-	if (!wsi || !wsi->vhost || !wsi->ws)
+	if (!wsi || !wsi->a.vhost || !wsi->ws)
 		return 0;
 
-	ext = wsi->vhost->ws.extensions;
+	ext = wsi->a.vhost->ws.extensions;
 
 	while (ext && ext->callback && !handled) {
 		m = ext->callback(context, ext, wsi, reason,
@@ -333,7 +333,7 @@ int
 lws_any_extension_handled(struct lws *wsi, enum lws_extension_callback_reasons r,
 			  void *v, size_t len)
 {
-	struct lws_context *context = wsi->context;
+	struct lws_context *context = wsi->a.context;
 	int n, handled = 0;
 
 	if (!wsi->ws)
@@ -376,7 +376,7 @@ lws_set_extension_option(struct lws *wsi, const char *ext_name,
 	oa.start = opt_val;
 	oa.len = 0;
 
-	return wsi->ws->active_extensions[idx]->callback(wsi->context,
+	return wsi->ws->active_extensions[idx]->callback(wsi->a.context,
 			wsi->ws->active_extensions[idx], wsi,
 			LWS_EXT_CB_NAMED_OPTION_SET, wsi->ws->act_ext_user[idx],
 			&oa, 0);
diff --git a/lib/roles/ws/ops-ws.c b/lib/roles/ws/ops-ws.c
index 13ce89ab0..e7cd5947d 100644
--- a/lib/roles/ws/ops-ws.c
+++ b/lib/roles/ws/ops-ws.c
@@ -156,7 +156,7 @@ handle_first:
 		switch (wsi->ws->opcode) {
 		case LWSWSOPC_TEXT_FRAME:
 			wsi->ws->check_utf8 = lws_check_opt(
-				wsi->context->options,
+				wsi->a.context->options,
 				LWS_SERVER_OPTION_VALIDATE_UTF8);
 			/* fallthru */
 		case LWSWSOPC_BINARY_FRAME:
@@ -422,12 +422,12 @@ handle_first:
 		 * if there's no protocol max frame size given, we are
 		 * supposed to default to context->pt_serv_buf_size
 		 */
-		if (!wsi->protocol->rx_buffer_size &&
-		    wsi->ws->rx_ubuf_head != wsi->context->pt_serv_buf_size)
+		if (!wsi->a.protocol->rx_buffer_size &&
+		    wsi->ws->rx_ubuf_head != wsi->a.context->pt_serv_buf_size)
 			break;
 
-		if (wsi->protocol->rx_buffer_size &&
-		    wsi->ws->rx_ubuf_head != wsi->protocol->rx_buffer_size)
+		if (wsi->a.protocol->rx_buffer_size &&
+		    wsi->ws->rx_ubuf_head != wsi->a.protocol->rx_buffer_size)
 			break;
 
 		/* spill because we filled our rx buffer */
@@ -437,7 +437,7 @@ spill:
 		 * layer?  If so service it and hide it from the user callback
 		 */
 
-		lwsl_parser("spill on %s\n", wsi->protocol->name);
+		lwsl_parser("spill on %s\n", wsi->a.protocol->name);
 
 		switch (wsi->ws->opcode) {
 		case LWSWSOPC_CLOSE:
@@ -448,7 +448,7 @@ spill:
 			wsi->ws->peer_has_sent_close = 1;
 
 			pp = &wsi->ws->rx_ubuf[LWS_PRE];
-			if (lws_check_opt(wsi->context->options,
+			if (lws_check_opt(wsi->a.context->options,
 					  LWS_SERVER_OPTION_VALIDATE_UTF8) &&
 			    wsi->ws->rx_ubuf_head > 2 &&
 			    lws_check_utf8(&wsi->ws->utf8, pp + 2,
@@ -498,7 +498,7 @@ spill:
 			}
 
 			if (user_callback_handle_rxflow(
-					wsi->protocol->callback, wsi,
+					wsi->a.protocol->callback, wsi,
 					LWS_CALLBACK_WS_PEER_INITIATED_CLOSE,
 					wsi->user_space,
 					&wsi->ws->rx_ubuf[LWS_PRE],
@@ -706,14 +706,14 @@ utf8_fail:
 				if (pmdrx.eb_out.len)
 					pmdrx.eb_out.token[pmdrx.eb_out.len] = '\0';
 
-				if (wsi->protocol->callback &&
+				if (wsi->a.protocol->callback &&
 				    !(already_processed & ALREADY_PROCESSED_NO_CB)) {
 					if (callback_action ==
 						      LWS_CALLBACK_RECEIVE_PONG)
 						lwsl_info("Doing pong callback\n");
 
 					ret = user_callback_handle_rxflow(
-						wsi->protocol->callback, wsi,
+						wsi->a.protocol->callback, wsi,
 						(enum lws_callback_reasons)
 							     callback_action,
 						wsi->user_space,
@@ -764,7 +764,7 @@ void
 lws_add_wsi_to_draining_ext_list(struct lws *wsi)
 {
 #if !defined(LWS_WITHOUT_EXTENSIONS)
-	struct lws_context_per_thread *pt = &wsi->context->pt[(int)wsi->tsi];
+	struct lws_context_per_thread *pt = &wsi->a.context->pt[(int)wsi->tsi];
 
 	if (wsi->ws->rx_draining_ext)
 		return;
@@ -781,7 +781,7 @@ void
 lws_remove_wsi_from_draining_ext_list(struct lws *wsi)
 {
 #if !defined(LWS_WITHOUT_EXTENSIONS)
-	struct lws_context_per_thread *pt = &wsi->context->pt[(int)wsi->tsi];
+	struct lws_context_per_thread *pt = &wsi->a.context->pt[(int)wsi->tsi];
 	struct lws **w = &pt->ws.rx_draining_ext_list;
 
 	if (!wsi->ws->rx_draining_ext)
@@ -836,9 +836,9 @@ lws_server_init_wsi_for_ws(struct lws *wsi)
 	 * a big default for compatibility
 	 */
 
-	n = (int)wsi->protocol->rx_buffer_size;
+	n = (int)wsi->a.protocol->rx_buffer_size;
 	if (!n)
-		n = wsi->context->pt_serv_buf_size;
+		n = wsi->a.context->pt_serv_buf_size;
 	n += LWS_PRE;
 	wsi->ws->rx_ubuf = lws_malloc(n + 4 /* 0x0000ffff zlib */, "rx_ubuf");
 	if (!wsi->ws->rx_ubuf) {
@@ -849,8 +849,8 @@ lws_server_init_wsi_for_ws(struct lws *wsi)
 
 	/* notify user code that we're ready to roll */
 
-	if (wsi->protocol->callback)
-		if (wsi->protocol->callback(wsi, LWS_CALLBACK_ESTABLISHED,
+	if (wsi->a.protocol->callback)
+		if (wsi->a.protocol->callback(wsi, LWS_CALLBACK_ESTABLISHED,
 					    wsi->user_space,
 #ifdef LWS_WITH_TLS
 					    wsi->tls.ssl,
@@ -954,7 +954,7 @@ rops_handle_POLLIN_ws(struct lws_context_per_thread *pt, struct lws *wsi,
 		return LWS_HPI_RET_PLEASE_CLOSE_ME;
 	}
 
-	// lwsl_notice("%s: %s\n", __func__, wsi->protocol->name);
+	// lwsl_notice("%s: %s\n", __func__, wsi->a.protocol->name);
 
 	//lwsl_info("%s: wsistate 0x%x, pollout %d\n", __func__,
 	//	   wsi->wsistate, pollfd->revents & LWS_POLLOUT);
@@ -1123,10 +1123,10 @@ read:
 		if (lwsi_role_ws(wsi))
 			ebuf.len = wsi->ws->rx_ubuf_alloc;
 		else
-			ebuf.len = wsi->context->pt_serv_buf_size;
+			ebuf.len = wsi->a.context->pt_serv_buf_size;
 
-		if ((unsigned int)ebuf.len > wsi->context->pt_serv_buf_size)
-			ebuf.len = wsi->context->pt_serv_buf_size;
+		if ((unsigned int)ebuf.len > wsi->a.context->pt_serv_buf_size)
+			ebuf.len = wsi->a.context->pt_serv_buf_size;
 
 		if ((int)pending > ebuf.len)
 			pending = ebuf.len;
@@ -1214,8 +1214,8 @@ drain:
 			pending = pending > wsi->ws->rx_ubuf_alloc ?
 				wsi->ws->rx_ubuf_alloc : pending;
 		else
-			pending = pending > wsi->context->pt_serv_buf_size ?
-				wsi->context->pt_serv_buf_size : pending;
+			pending = pending > wsi->a.context->pt_serv_buf_size ?
+				wsi->a.context->pt_serv_buf_size : pending;
 		goto read;
 	}
 
@@ -1246,7 +1246,7 @@ int rops_handle_POLLOUT_ws(struct lws *wsi)
 
 #if !defined(LWS_WITHOUT_EXTENSIONS)
 	lwsl_debug("%s: %s: wsi->ws->tx_draining_ext %d\n", __func__,
-			wsi->protocol->name, wsi->ws->tx_draining_ext);
+			wsi->a.protocol->name, wsi->ws->tx_draining_ext);
 #endif
 
 	/* Priority 3: pending control packets (pong or close)
@@ -1317,7 +1317,7 @@ int rops_handle_POLLOUT_ws(struct lws *wsi)
 	    wsi->ws->send_check_ping) {
 
 		lwsl_info("%s: issuing ping on wsi %p: %s %s h2: %d\n", __func__, wsi,
-				wsi->role_ops->name, wsi->protocol->name,
+				wsi->role_ops->name, wsi->a.protocol->name,
 				wsi->mux_substream);
 		wsi->ws->send_check_ping = 0;
 		n = lws_write(wsi, &wsi->ws->ping_payload_buf[LWS_PRE],
@@ -1565,7 +1565,7 @@ rops_write_role_protocol_ws(struct lws *wsi, unsigned char *buf, size_t len,
 			    enum lws_write_protocol *wp)
 {
 #if !defined(LWS_WITHOUT_EXTENSIONS)
-	struct lws_context_per_thread *pt = &wsi->context->pt[(int)wsi->tsi];
+	struct lws_context_per_thread *pt = &wsi->a.context->pt[(int)wsi->tsi];
 	enum lws_write_protocol wpt;
 #endif
 	struct lws_ext_pm_deflate_rx_ebufs pmdrx;
diff --git a/lib/roles/ws/server-ws.c b/lib/roles/ws/server-ws.c
index ece465d2b..66e1b0866 100644
--- a/lib/roles/ws/server-ws.c
+++ b/lib/roles/ws/server-ws.c
@@ -30,7 +30,7 @@
 static int
 lws_extension_server_handshake(struct lws *wsi, char **p, int budget)
 {
-	struct lws_context *context = wsi->context;
+	struct lws_context *context = wsi->a.context;
 	struct lws_context_per_thread *pt = &context->pt[(int)wsi->tsi];
 	char ext_name[64], *args, *end = (*p) + budget - 1;
 	const struct lws_ext_options *opts, *po;
@@ -112,7 +112,7 @@ lws_extension_server_handshake(struct lws *wsi, char **p, int budget)
 
 		/* check a client's extension against our support */
 
-		ext = wsi->vhost->ws.extensions;
+		ext = wsi->a.vhost->ws.extensions;
 
 		while (ext && ext->callback) {
 
@@ -135,7 +135,7 @@ lws_extension_server_handshake(struct lws *wsi, char **p, int budget)
 			 * ask user code if it's OK to apply it on this
 			 * particular connection + protocol
 			 */
-			m = (wsi->protocol->callback)(wsi,
+			m = (wsi->a.protocol->callback)(wsi,
 				LWS_CALLBACK_CONFIRM_EXTENSION_OKAY,
 				wsi->user_space, ext_name, 0);
 
@@ -254,7 +254,7 @@ lws_extension_server_handshake(struct lws *wsi, char **p, int budget)
 int
 lws_process_ws_upgrade2(struct lws *wsi)
 {
-	struct lws_context_per_thread *pt = &wsi->context->pt[(int)wsi->tsi];
+	struct lws_context_per_thread *pt = &wsi->a.context->pt[(int)wsi->tsi];
 #if defined(LWS_WITH_HTTP_BASIC_AUTH)
 	const struct lws_protocol_vhost_options *pvos = NULL;
 	const char *ws_prot_basic_auth = NULL;
@@ -268,7 +268,7 @@ lws_process_ws_upgrade2(struct lws *wsi)
 	 * section, as a pvo.
 	 */
 
-	pvos = lws_vhost_protocol_options(wsi->vhost, wsi->protocol->name);
+	pvos = lws_vhost_protocol_options(wsi->a.vhost, wsi->a.protocol->name);
 	if (pvos && pvos->options &&
 	    !lws_pvo_get_str((void *)pvos->options, "basic-auth",
 			     &ws_prot_basic_auth)) {
@@ -325,7 +325,7 @@ lws_process_ws_upgrade2(struct lws *wsi)
 	 * Give the user code a chance to study the request and
 	 * have the opportunity to deny it
 	 */
-	if ((wsi->protocol->callback)(wsi,
+	if ((wsi->a.protocol->callback)(wsi,
 			LWS_CALLBACK_FILTER_PROTOCOL_CONNECTION,
 			wsi->user_space,
 		      lws_hdr_simple_ptr(wsi, WSI_TOKEN_PROTOCOL), 0)) {
@@ -367,7 +367,7 @@ lws_process_ws_upgrade2(struct lws *wsi)
 #endif
 		{
 			lwsl_parser("lws_parse calling handshake_04\n");
-			if (handshake_0405(wsi->context, wsi)) {
+			if (handshake_0405(wsi->a.context, wsi)) {
 				lwsl_notice("hs0405 has failed the connection\n");
 				return 1;
 			}
@@ -393,7 +393,7 @@ lws_process_ws_upgrade2(struct lws *wsi)
 
 		lws_strnncpy(dotstar, uptr, l, sizeof(dotstar));
 		l = lws_snprintf(combo, sizeof(combo), "%s (%s)", dotstar,
-				 wsi->protocol->name);
+				 wsi->a.protocol->name);
 
 		if (meth < 0)
 			meth = 0;
@@ -417,7 +417,7 @@ lws_process_ws_upgrade(struct lws *wsi)
 	lws_tokenize_elem e;
 	int n;
 
-	if (!wsi->protocol)
+	if (!wsi->a.protocol)
 		lwsl_err("NULL protocol at lws_read\n");
 
 	/*
@@ -509,7 +509,7 @@ lws_process_ws_upgrade(struct lws *wsi)
 	}
 	ts.len = n;
 	if (!ts.len) {
-		int n = wsi->vhost->default_protocol_index;
+		int n = wsi->a.vhost->default_protocol_index;
 		/*
 		 * Some clients only have one protocol and do not send the
 		 * protocol list header... allow it and match to the vhost's
@@ -520,7 +520,7 @@ lws_process_ws_upgrade(struct lws *wsi)
 		 * these "no protocol" ws connections to be rejected.
 		 */
 
-		if (n >= wsi->vhost->count_protocols) {
+		if (n >= wsi->a.vhost->count_protocols) {
 			lwsl_notice("%s: rejecting ws upg with no protocol\n",
 				    __func__);
 
@@ -529,7 +529,7 @@ lws_process_ws_upgrade(struct lws *wsi)
 
 		lwsl_info("%s: defaulting to prot handler %d\n", __func__, n);
 
-		lws_bind_protocol(wsi, &wsi->vhost->protocols[n],
+		lws_bind_protocol(wsi, &wsi->a.vhost->protocols[n],
 				  "ws upgrade default pcol");
 
 		goto alloc_ws;
@@ -548,7 +548,7 @@ lws_process_ws_upgrade(struct lws *wsi)
 				return 1;
 			}
 			lwsl_debug("checking %s\n", name);
-			pcol = lws_vhost_name_to_protocol(wsi->vhost, name);
+			pcol = lws_vhost_name_to_protocol(wsi->a.vhost, name);
 			if (pcol) {
 				/* if we know it, bind to it and stop looking */
 				lws_bind_protocol(wsi, pcol, "ws upg pcol");
@@ -642,9 +642,9 @@ handshake_0405(struct lws_context *context, struct lws *wsi)
 	 *  - one came in, and ... */
 	if (lws_hdr_total_length(wsi, WSI_TOKEN_PROTOCOL) &&
 	    /*  - it is not an empty string */
-	    wsi->protocol->name &&
-	    wsi->protocol->name[0]) {
-		const char *prot = wsi->protocol->name;
+	    wsi->a.protocol->name &&
+	    wsi->a.protocol->name[0]) {
+		const char *prot = wsi->a.protocol->name;
 
 #if defined(LWS_WITH_HTTP_PROXY)
 		if (wsi->proxied_ws_parent && wsi->child_list)
@@ -670,7 +670,7 @@ handshake_0405(struct lws_context *context, struct lws *wsi)
 	args.p = p;
 	args.max_len = lws_ptr_diff((char *)pt->serv_buf +
 				    context->pt_serv_buf_size, p);
-	if (user_callback_handle_rxflow(wsi->protocol->callback, wsi,
+	if (user_callback_handle_rxflow(wsi->a.protocol->callback, wsi,
 					LWS_CALLBACK_ADD_HEADERS,
 					wsi->user_space, &args, 0))
 		goto bail;
@@ -707,7 +707,7 @@ handshake_0405(struct lws_context *context, struct lws *wsi)
 		const struct lws_http_mount *hit =
 			lws_find_mount(wsi, uri_ptr, uri_len);
 		if (hit && hit->cgienv &&
-		    wsi->protocol->callback(wsi, LWS_CALLBACK_HTTP_PMO,
+		    wsi->a.protocol->callback(wsi, LWS_CALLBACK_HTTP_PMO,
 			wsi->user_space, (void *)hit->cgienv, 0))
 			return 1;
 	}
@@ -749,10 +749,10 @@ lws_ws_frame_rest_is_payload(struct lws *wsi, uint8_t **buf, size_t len)
 	if (!wsi->ws->count_act_ext)
 #endif
 	{
-		if (wsi->protocol->rx_buffer_size)
-			avail = (int)wsi->protocol->rx_buffer_size;
+		if (wsi->a.protocol->rx_buffer_size)
+			avail = (int)wsi->a.protocol->rx_buffer_size;
 		else
-			avail = wsi->context->pt_serv_buf_size;
+			avail = wsi->a.context->pt_serv_buf_size;
 	}
 
 	/* do not consume more than we should */
@@ -839,12 +839,12 @@ lws_ws_frame_rest_is_payload(struct lws *wsi, uint8_t **buf, size_t len)
 	    old_packet_length &&	    /* we gave the inflator new input */
 	    !wsi->ws->rx_packet_length &&   /* raw ws packet payload all gone */
 	    wsi->ws->final &&		    /* the raw ws packet is a FIN guy */
-	    wsi->protocol->callback &&
+	    wsi->a.protocol->callback &&
 	    !wsi->wsistate_pre_close) {
 
 		lwsl_ext("%s: issuing zero length FIN pkt\n", __func__);
 
-		if (user_callback_handle_rxflow(wsi->protocol->callback, wsi,
+		if (user_callback_handle_rxflow(wsi->a.protocol->callback, wsi,
 						LWS_CALLBACK_RECEIVE,
 						wsi->user_space, NULL, 0))
 			return -1;
@@ -891,8 +891,8 @@ utf8_fail:
 		}
 	}
 
-	if (wsi->protocol->callback && !wsi->wsistate_pre_close)
-		if (user_callback_handle_rxflow(wsi->protocol->callback, wsi,
+	if (wsi->a.protocol->callback && !wsi->wsistate_pre_close)
+		if (user_callback_handle_rxflow(wsi->a.protocol->callback, wsi,
 						LWS_CALLBACK_RECEIVE,
 						wsi->user_space,
 						pmdrx.eb_out.token,
diff --git a/lib/secure-streams/protocols/ss-h1.c b/lib/secure-streams/protocols/ss-h1.c
index 39fe18d58..36fa71173 100644
--- a/lib/secure-streams/protocols/ss-h1.c
+++ b/lib/secure-streams/protocols/ss-h1.c
@@ -208,7 +208,7 @@ secstream_h1(struct lws *wsi, enum lws_callback_reasons reason, void *user,
 		//bad = status != 200;
 		//lws_cancel_service(lws_get_context(wsi)); /* abort poll wait */
 		if (h->policy && !(h->policy->flags & LWSSSPOLF_OPPORTUNISTIC) &&
-		    !h->txn_ok && !wsi->context->being_destroyed) {
+		    !h->txn_ok && !wsi->a.context->being_destroyed) {
 			if (lws_ss_backoff(h))
 				break;
 		} else
@@ -345,7 +345,7 @@ malformed:
 
 			buflen = sizeof(buf) - o - 2;
 			n = lws_system_blob_get(
-				lws_system_get_blob(wsi->context, blob_idx[m], 0),
+				lws_system_get_blob(wsi->a.context, blob_idx[m], 0),
 						    buf + o, &buflen, 0);
 			if (n < 0)
 				return -1;
@@ -532,7 +532,7 @@ malformed:
 				conceal_eom = 0;
 #endif
 			} else {
-				h->rideshare = lws_ss_policy_lookup(wsi->context,
+				h->rideshare = lws_ss_policy_lookup(wsi->a.context,
 						h->rideshare->rideshare_streamtype);
 				lws_callback_on_writable(wsi);
 			}
diff --git a/lib/secure-streams/protocols/ss-mqtt.c b/lib/secure-streams/protocols/ss-mqtt.c
index 0e857258f..66dc39fb1 100644
--- a/lib/secure-streams/protocols/ss-mqtt.c
+++ b/lib/secure-streams/protocols/ss-mqtt.c
@@ -73,7 +73,7 @@ secstream_mqtt(struct lws *wsi, enum lws_callback_reasons reason, void *user,
 		}
 
 		if (h->policy && !(h->policy->flags & LWSSSPOLF_OPPORTUNISTIC) &&
-		    !h->txn_ok && !wsi->context->being_destroyed)
+		    !h->txn_ok && !wsi->a.context->being_destroyed)
 			if (lws_ss_backoff(h))
 				/* has been destroyed */
 				return -1;
diff --git a/lib/secure-streams/protocols/ss-raw.c b/lib/secure-streams/protocols/ss-raw.c
index 1d0c8a255..fc0d5b91a 100644
--- a/lib/secure-streams/protocols/ss-raw.c
+++ b/lib/secure-streams/protocols/ss-raw.c
@@ -58,7 +58,7 @@ secstream_raw(struct lws *wsi, enum lws_callback_reasons reason, void *user,
 			  h->policy ? h->policy->streamtype : "no policy");
 		h->wsi = NULL;
 		if (h->policy && !(h->policy->flags & LWSSSPOLF_OPPORTUNISTIC) &&
-		    !h->txn_ok && !wsi->context->being_destroyed)
+		    !h->txn_ok && !wsi->a.context->being_destroyed)
 			if (lws_ss_backoff(h))
 				/* has been destroyed */
 				break;
diff --git a/lib/secure-streams/protocols/ss-ws.c b/lib/secure-streams/protocols/ss-ws.c
index 10a3bd5fe..b24ddea61 100644
--- a/lib/secure-streams/protocols/ss-ws.c
+++ b/lib/secure-streams/protocols/ss-ws.c
@@ -62,7 +62,7 @@ secstream_ws(struct lws *wsi, enum lws_callback_reasons reason, void *user,
 		h->wsi = NULL;
 
 		if (h->policy && !(h->policy->flags & LWSSSPOLF_OPPORTUNISTIC) &&
-		    !h->txn_ok && !wsi->context->being_destroyed)
+		    !h->txn_ok && !wsi->a.context->being_destroyed)
 			lws_ss_backoff(h);
 		/* may have been destroyed */
 		break;
diff --git a/lib/secure-streams/secure-streams-process.c b/lib/secure-streams/secure-streams-process.c
index c7080be14..a830c9f58 100644
--- a/lib/secure-streams/secure-streams-process.c
+++ b/lib/secure-streams/secure-streams-process.c
@@ -227,7 +227,7 @@ static int
 callback_ss_proxy(struct lws *wsi, enum lws_callback_reasons reason,
 		  void *user, void *in, size_t len)
 {
-	struct lws_context_per_thread *pt = &wsi->context->pt[(int)wsi->tsi];
+	struct lws_context_per_thread *pt = &wsi->a.context->pt[(int)wsi->tsi];
 	struct raw_pss *pss = (struct raw_pss *)user;
 	const lws_ss_policy_t *rsp;
 	struct conn *conn = NULL;
@@ -399,7 +399,7 @@ callback_ss_proxy(struct lws *wsi, enum lws_callback_reasons reason,
 						s[n++] = ',';
 					n += lws_snprintf(&s[n], sizeof(s) - n,
 							"%s", rsp->streamtype);
-					rsp = lws_ss_policy_lookup(wsi->context,
+					rsp = lws_ss_policy_lookup(wsi->a.context,
 						rsp->rideshare_streamtype);
 				}
 			}
@@ -415,7 +415,7 @@ callback_ss_proxy(struct lws *wsi, enum lws_callback_reasons reason,
 
 #if defined(LWS_WITH_DETAILED_LATENCY)
 			if (cp[0] == LWSSS_SER_RXPRE_RX_PAYLOAD &&
-			    wsi->context->detailed_latency_cb) {
+			    wsi->a.context->detailed_latency_cb) {
 
 				/*
 				 * we're fulfilling rx that came in on ss
diff --git a/lib/secure-streams/secure-streams-serialize.c b/lib/secure-streams/secure-streams-serialize.c
index d79fdc00d..bcab7f98e 100644
--- a/lib/secure-streams/secure-streams-serialize.c
+++ b/lib/secure-streams/secure-streams-serialize.c
@@ -206,7 +206,7 @@ lws_ss_deserialize_tx_payload(struct lws_dsh *dsh, struct lws *wsi,
 	*flags = lws_ser_ru32be(&p[3]);
 
 #if defined(LWS_WITH_DETAILED_LATENCY)
-	if (wsi && wsi->context->detailed_latency_cb) {
+	if (wsi && wsi->a.context->detailed_latency_cb) {
 		/*
 		 * use the proxied latency information to compute the client
 		 * and our delays, and apply to wsi.
diff --git a/lib/system/async-dns/async-dns.c b/lib/system/async-dns/async-dns.c
index 88deb4bea..8fbd7458a 100644
--- a/lib/system/async-dns/async-dns.c
+++ b/lib/system/async-dns/async-dns.c
@@ -472,7 +472,7 @@ cancel(struct lws_dll2 *d, void *user)
 void
 lws_async_dns_cancel(struct lws *wsi)
 {
-	lws_async_dns_t *dns = &wsi->context->async_dns;
+	lws_async_dns_t *dns = &wsi->a.context->async_dns;
 
 	lws_dll2_foreach_safe(&dns->waiting, wsi, cancel);
 }
diff --git a/lib/system/dhcpclient/dhcpclient.c b/lib/system/dhcpclient/dhcpclient.c
index be0251e98..5e870dc02 100644
--- a/lib/system/dhcpclient/dhcpclient.c
+++ b/lib/system/dhcpclient/dhcpclient.c
@@ -220,7 +220,7 @@ lws_dhcpc_retry_conn(struct lws_sorted_usec_list *sul)
 	r->wsi_raw->user_space = r;
 	r->wsi_raw->user_space_externally_allocated = 1;
 
-	lws_get_random(r->wsi_raw->context, r->xid, 4);
+	lws_get_random(r->wsi_raw->a.context, r->xid, 4);
 }
 
 static void
@@ -544,7 +544,7 @@ broken:
 					(const char *)&r[1]);
 			r->state = LDHC_BOUND;
 
-			lws_state_transition_steps(&wsi->context->mgr_system,
+			lws_state_transition_steps(&wsi->a.context->mgr_system,
 						   LWS_SYSTATE_OPERATIONAL);
 
 			r->cb(r->opaque, r->af,
@@ -618,7 +618,7 @@ bcast:
 		return 0;
 
 retry_conn:
-		lws_retry_sul_schedule(wsi->context, 0, &r->sul_conn, &bo2,
+		lws_retry_sul_schedule(wsi->a.context, 0, &r->sul_conn, &bo2,
 				       lws_dhcpc_retry_conn,
 				       &r->retry_count_conn);
 
diff --git a/lib/system/ntpclient/ntpclient.c b/lib/system/ntpclient/ntpclient.c
index 550650199..4fb82e305 100644
--- a/lib/system/ntpclient/ntpclient.c
+++ b/lib/system/ntpclient/ntpclient.c
@@ -123,18 +123,18 @@ callback_ntpc(struct lws *wsi, enum lws_callback_reasons reason, void *user,
 			break;
 
 		lwsl_debug("%s: LWS_CALLBACK_PROTOCOL_INIT:\n", __func__);
-		lws_protocol_vh_priv_zalloc(wsi->vhost, wsi->protocol,
+		lws_protocol_vh_priv_zalloc(wsi->a.vhost, wsi->a.protocol,
 					    sizeof(*v));
-		v = (struct vhd_ntpc *)lws_protocol_vh_priv_get(wsi->vhost,
-								wsi->protocol);
+		v = (struct vhd_ntpc *)lws_protocol_vh_priv_get(wsi->a.vhost,
+								wsi->a.protocol);
 		v->context = lws_get_context(wsi);
 		v->vhost = lws_get_vhost(wsi);
 		v->protocol = lws_get_protocol(wsi);
 
 		v->context->ntpclient_priv = v;
 
-		if (!lws_system_get_ops(wsi->context) ||
-		    !lws_system_get_ops(wsi->context)->set_clock) {
+		if (!lws_system_get_ops(wsi->a.context) ||
+		    !lws_system_get_ops(wsi->a.context)->set_clock) {
 #if !defined(LWS_ESP_PLATFORM)
 			lwsl_err("%s: set up system ops for set_clock\n",
 					__func__);
@@ -226,17 +226,17 @@ do_close:
 			t.tv_sec = (unsigned long long)ns / 1000000000;
 			t.tv_usec = (ns % 1000000000) / 1000;
 
-			lws_sul_nonmonotonic_adjust(wsi->context, delta_us);
+			lws_sul_nonmonotonic_adjust(wsi->a.context, delta_us);
 
 			settimeofday(&t, NULL);
 		}
 #endif
-		if (lws_system_get_ops(wsi->context) &&
-		    lws_system_get_ops(wsi->context)->set_clock)
-			lws_system_get_ops(wsi->context)->set_clock(ns / 1000);
+		if (lws_system_get_ops(wsi->a.context) &&
+		    lws_system_get_ops(wsi->a.context)->set_clock)
+			lws_system_get_ops(wsi->a.context)->set_clock(ns / 1000);
 
 		v->set_time = 1;
-		lws_state_transition_steps(&wsi->context->mgr_system,
+		lws_state_transition_steps(&wsi->a.context->mgr_system,
 					   LWS_SYSTATE_OPERATIONAL);
 
 		/* close the wsi */
@@ -276,7 +276,7 @@ do_close:
 		lwsl_err("%s: Failed to write ntp client req\n", __func__);
 
 retry_conn:
-		lws_retry_sul_schedule(wsi->context, 0, &v->sul_conn, &bo,
+		lws_retry_sul_schedule(wsi->a.context, 0, &v->sul_conn, &bo,
 				       lws_ntpc_retry_conn,
 				       &v->retry_count_conn);
 
diff --git a/lib/tls/mbedtls/mbedtls-client.c b/lib/tls/mbedtls/mbedtls-client.c
index f93774aaa..39ab156d5 100644
--- a/lib/tls/mbedtls/mbedtls-client.c
+++ b/lib/tls/mbedtls/mbedtls-client.c
@@ -34,7 +34,7 @@ int
 lws_ssl_client_bio_create(struct lws *wsi)
 {
 	char hostname[128], *p;
-	const char *alpn_comma = wsi->context->tls.alpn_default;
+	const char *alpn_comma = wsi->a.context->tls.alpn_default;
 	struct alpn_ctx protos;
 
 	if (wsi->stash)
@@ -60,13 +60,13 @@ lws_ssl_client_bio_create(struct lws *wsi)
 		p++;
 	}
 
-	wsi->tls.ssl = SSL_new(wsi->vhost->tls.ssl_client_ctx);
+	wsi->tls.ssl = SSL_new(wsi->a.vhost->tls.ssl_client_ctx);
 	if (!wsi->tls.ssl) {
 		lwsl_info("%s: SSL_new() failed\n", __func__);
 		return -1;
 	}
 
-	if (wsi->vhost->tls.ssl_info_event_mask)
+	if (wsi->a.vhost->tls.ssl_info_event_mask)
 		SSL_set_info_callback(wsi->tls.ssl, lws_ssl_info_callback);
 
 	if (!(wsi->tls.use_ssl & LCCSCF_SKIP_SERVER_CERT_HOSTNAME_CHECK)) {
@@ -77,8 +77,8 @@ lws_ssl_client_bio_create(struct lws *wsi)
 		X509_VERIFY_PARAM_set1_host(param, hostname, 0);
 	}
 
-	if (wsi->vhost->tls.alpn)
-		alpn_comma = wsi->vhost->tls.alpn;
+	if (wsi->a.vhost->tls.alpn)
+		alpn_comma = wsi->a.vhost->tls.alpn;
 
 	if (wsi->stash) {
 		lws_strncpy(hostname, wsi->stash->cis[CIS_HOST], sizeof(hostname));
@@ -108,7 +108,7 @@ lws_ssl_client_bio_create(struct lws *wsi)
 	SSL_set_fd(wsi->tls.ssl, wsi->desc.sockfd);
 
 	if (wsi->sys_tls_client_cert) {
-		lws_system_blob_t *b = lws_system_get_blob(wsi->context,
+		lws_system_blob_t *b = lws_system_get_blob(wsi->a.context,
 					LWS_SYSBLOB_TYPE_CLIENT_CERT_DER,
 					wsi->sys_tls_client_cert - 1);
 		const uint8_t *data;
@@ -131,7 +131,7 @@ lws_ssl_client_bio_create(struct lws *wsi)
 		if (SSL_use_certificate_ASN1(wsi->tls.ssl, data, size) != 1)
 			goto no_client_cert;
 
-		b = lws_system_get_blob(wsi->context,
+		b = lws_system_get_blob(wsi->a.context,
 					LWS_SYSBLOB_TYPE_CLIENT_KEY_DER,
 					wsi->sys_tls_client_cert - 1);
 		if (!b)
@@ -201,7 +201,7 @@ lws_tls_client_confirm_peer_cert(struct lws *wsi, char *ebuf, int ebuf_len)
 {
 	int n;
 	X509 *peer = SSL_get_peer_certificate(wsi->tls.ssl);
-	struct lws_context_per_thread *pt = &wsi->context->pt[(int)wsi->tsi];
+	struct lws_context_per_thread *pt = &wsi->a.context->pt[(int)wsi->tsi];
 	char *sb = (char *)&pt->serv_buf[0];
 
 	if (!peer) {
diff --git a/lib/tls/mbedtls/mbedtls-server.c b/lib/tls/mbedtls/mbedtls-server.c
index dcdf9d31c..db1c80670 100644
--- a/lib/tls/mbedtls/mbedtls-server.c
+++ b/lib/tls/mbedtls/mbedtls-server.c
@@ -265,7 +265,7 @@ int
 lws_tls_server_new_nonblocking(struct lws *wsi, lws_sockfd_type accept_fd)
 {
 	errno = 0;
-	wsi->tls.ssl = SSL_new(wsi->vhost->tls.ssl_ctx);
+	wsi->tls.ssl = SSL_new(wsi->a.vhost->tls.ssl_ctx);
 	if (wsi->tls.ssl == NULL) {
 		lwsl_err("SSL_new failed: errno %d\n", errno);
 
@@ -275,10 +275,10 @@ lws_tls_server_new_nonblocking(struct lws *wsi, lws_sockfd_type accept_fd)
 
 	SSL_set_fd(wsi->tls.ssl, accept_fd);
 
-	if (wsi->vhost->tls.ssl_info_event_mask)
+	if (wsi->a.vhost->tls.ssl_info_event_mask)
 		SSL_set_info_callback(wsi->tls.ssl, lws_ssl_info_callback);
 
-	SSL_set_sni_callback(wsi->tls.ssl, lws_mbedtls_sni_cb, wsi->context);
+	SSL_set_sni_callback(wsi->tls.ssl, lws_mbedtls_sni_cb, wsi->a.context);
 
 	return 0;
 }
@@ -307,7 +307,7 @@ lws_tls_server_accept(struct lws *wsi)
 	wsi->skip_fallback = 1;
 	if (n == 1) {
 
-		if (strstr(wsi->vhost->name, ".invalid")) {
+		if (strstr(wsi->a.vhost->name, ".invalid")) {
 			lwsl_notice("%s: vhost has .invalid, "
 				    "rejecting accept\n", __func__);
 
diff --git a/lib/tls/mbedtls/mbedtls-ssl.c b/lib/tls/mbedtls/mbedtls-ssl.c
index ae2d209df..db5489e6f 100644
--- a/lib/tls/mbedtls/mbedtls-ssl.c
+++ b/lib/tls/mbedtls/mbedtls-ssl.c
@@ -44,7 +44,7 @@ lws_ssl_destroy(struct lws_vhost *vhost)
 int
 lws_ssl_capable_read(struct lws *wsi, unsigned char *buf, int len)
 {
-	struct lws_context *context = wsi->context;
+	struct lws_context *context = wsi->a.context;
 	struct lws_context_per_thread *pt = &context->pt[(int)wsi->tsi];
 	int n = 0, m;
 
@@ -109,8 +109,8 @@ lws_ssl_capable_read(struct lws *wsi, unsigned char *buf, int len)
 	lws_stats_bump(pt, LWSSTATS_B_READ, n);
 
 #if defined(LWS_WITH_SERVER_STATUS)
-	if (wsi->vhost)
-		wsi->vhost->conn_stats.rx += n;
+	if (wsi->a.vhost)
+		wsi->a.vhost->conn_stats.rx += n;
 #endif
 #if defined(LWS_WITH_DETAILED_LATENCY)
 	if (context->detailed_latency_cb) {
@@ -120,7 +120,7 @@ lws_ssl_capable_read(struct lws *wsi, unsigned char *buf, int len)
 		wsi->detlat.latencies[LAT_DUR_PROXY_RX_TO_ONWARD_TX] =
 			lws_now_usecs() - pt->ust_left_poll;
 		wsi->detlat.latencies[LAT_DUR_USERCB] = 0;
-		lws_det_lat_cb(wsi->context, &wsi->detlat);
+		lws_det_lat_cb(wsi->a.context, &wsi->detlat);
 	}
 #endif
 	/*
@@ -210,13 +210,13 @@ lws_ssl_info_callback(const SSL *ssl, int where, int ret)
 	if (!wsi)
 		return;
 
-	if (!(where & wsi->vhost->tls.ssl_info_event_mask))
+	if (!(where & wsi->a.vhost->tls.ssl_info_event_mask))
 		return;
 
 	si.where = where;
 	si.ret = ret;
 
-	if (user_callback_handle_rxflow(wsi->protocol->callback,
+	if (user_callback_handle_rxflow(wsi->a.protocol->callback,
 					wsi, LWS_CALLBACK_SSL_INFO,
 					wsi->user_space, &si, 0))
 		lws_set_timeout(wsi, PENDING_TIMEOUT_KILLED_BY_SSL_INFO, -1);
@@ -235,7 +235,7 @@ lws_ssl_close(struct lws *wsi)
 	/* kill ssl callbacks, becausse we will remove the fd from the
 	 * table linking it to the wsi
 	 */
-	if (wsi->vhost->tls.ssl_info_event_mask)
+	if (wsi->a.vhost->tls.ssl_info_event_mask)
 		SSL_set_info_callback(wsi->tls.ssl, NULL);
 #endif
 
@@ -246,7 +246,7 @@ lws_ssl_close(struct lws *wsi)
 	SSL_free(wsi->tls.ssl);
 	wsi->tls.ssl = NULL;
 
-	lws_tls_restrict_return(wsi->context);
+	lws_tls_restrict_return(wsi->a.context);
 
 	return 1; /* handled */
 }
diff --git a/lib/tls/openssl/openssl-client.c b/lib/tls/openssl/openssl-client.c
index b19523fc4..65992bb49 100644
--- a/lib/tls/openssl/openssl-client.c
+++ b/lib/tls/openssl/openssl-client.c
@@ -100,7 +100,7 @@ OpenSSL_client_verify_callback(int preverify_ok, X509_STORE_CTX *x509_ctx)
 		return 0;
 	}
 
-	n = lws_get_context_protocol(wsi->context, 0).callback(wsi,
+	n = lws_get_context_protocol(wsi->a.context, 0).callback(wsi,
 			LWS_CALLBACK_OPENSSL_PERFORM_SERVER_CERT_VERIFICATION,
 			x509_ctx, ssl, preverify_ok);
 
@@ -138,7 +138,7 @@ lws_ssl_client_bio_create(struct lws *wsi)
 #if defined(LWS_HAVE_SSL_set_alpn_protos) && \
     defined(LWS_HAVE_SSL_get0_alpn_selected)
 	uint8_t openssl_alpn[40];
-	const char *alpn_comma = wsi->context->tls.alpn_default;
+	const char *alpn_comma = wsi->a.context->tls.alpn_default;
 	int n;
 #endif
 
@@ -173,7 +173,7 @@ lws_ssl_client_bio_create(struct lws *wsi)
 		p++;
 	}
 
-	wsi->tls.ssl = SSL_new(wsi->vhost->tls.ssl_client_ctx);
+	wsi->tls.ssl = SSL_new(wsi->a.vhost->tls.ssl_client_ctx);
 	if (!wsi->tls.ssl) {
 		lwsl_err("SSL_new failed: %s\n",
 		         ERR_error_string(lws_ssl_get_error(wsi, 0), NULL));
@@ -182,7 +182,7 @@ lws_ssl_client_bio_create(struct lws *wsi)
 	}
 
 #if defined (LWS_HAVE_SSL_SET_INFO_CALLBACK)
-	if (wsi->vhost->tls.ssl_info_event_mask)
+	if (wsi->a.vhost->tls.ssl_info_event_mask)
 		SSL_set_info_callback(wsi->tls.ssl, lws_ssl_info_callback);
 #endif
 
@@ -275,8 +275,8 @@ lws_ssl_client_bio_create(struct lws *wsi)
 
 #if defined(LWS_HAVE_SSL_set_alpn_protos) && \
     defined(LWS_HAVE_SSL_get0_alpn_selected)
-	if (wsi->vhost->tls.alpn)
-		alpn_comma = wsi->vhost->tls.alpn;
+	if (wsi->a.vhost->tls.alpn)
+		alpn_comma = wsi->a.vhost->tls.alpn;
 	if (wsi->stash)
 		alpn_comma = wsi->stash->cis[CIS_ALPN];
 #if defined(LWS_ROLE_H1) || defined(LWS_ROLE_H2)
@@ -297,7 +297,7 @@ lws_ssl_client_bio_create(struct lws *wsi)
 			wsi);
 
 	if (wsi->sys_tls_client_cert) {
-		lws_system_blob_t *b = lws_system_get_blob(wsi->context,
+		lws_system_blob_t *b = lws_system_get_blob(wsi->a.context,
 					LWS_SYSBLOB_TYPE_CLIENT_CERT_DER,
 					wsi->sys_tls_client_cert - 1);
 		const uint8_t *data;
@@ -327,7 +327,7 @@ lws_ssl_client_bio_create(struct lws *wsi)
 			goto no_client_cert;
 		}
 
-		b = lws_system_get_blob(wsi->context,
+		b = lws_system_get_blob(wsi->a.context,
 					LWS_SYSBLOB_TYPE_CLIENT_KEY_DER,
 					wsi->sys_tls_client_cert - 1);
 		if (!b)
@@ -446,7 +446,7 @@ int
 lws_tls_client_confirm_peer_cert(struct lws *wsi, char *ebuf, int ebuf_len)
 {
 #if !defined(USE_WOLFSSL)
-	struct lws_context_per_thread *pt = &wsi->context->pt[(int)wsi->tsi];
+	struct lws_context_per_thread *pt = &wsi->a.context->pt[(int)wsi->tsi];
 	char *p = (char *)&pt->serv_buf[0];
 	char *sb = p;
 	int n;
diff --git a/lib/tls/openssl/openssl-server.c b/lib/tls/openssl/openssl-server.c
index c90884639..4e0c380e5 100644
--- a/lib/tls/openssl/openssl-server.c
+++ b/lib/tls/openssl/openssl-server.c
@@ -59,7 +59,7 @@ OpenSSL_verify_callback(int preverify_ok, X509_STORE_CTX *x509_ctx)
 	else
 		lwsl_info("%s: couldn't get client cert CN\n", __func__);
 
-	n = wsi->vhost->protocols[0].callback(wsi,
+	n = wsi->a.vhost->protocols[0].callback(wsi,
 			LWS_CALLBACK_OPENSSL_PERFORM_CLIENT_CERT_VERIFICATION,
 					   x509_ctx, ssl, preverify_ok);
 
@@ -565,7 +565,7 @@ lws_tls_server_new_nonblocking(struct lws *wsi, lws_sockfd_type accept_fd)
 
 	errno = 0;
 	ERR_clear_error();
-	wsi->tls.ssl = SSL_new(wsi->vhost->tls.ssl_ctx);
+	wsi->tls.ssl = SSL_new(wsi->a.vhost->tls.ssl_ctx);
 	if (wsi->tls.ssl == NULL) {
 		lwsl_err("SSL_new failed: %d (errno %d)\n",
 			 lws_ssl_get_error(wsi, 0), errno);
@@ -600,7 +600,7 @@ lws_tls_server_new_nonblocking(struct lws *wsi, lws_sockfd_type accept_fd)
 #endif
 
 #if defined (LWS_HAVE_SSL_SET_INFO_CALLBACK)
-		if (wsi->vhost->tls.ssl_info_event_mask)
+		if (wsi->a.vhost->tls.ssl_info_event_mask)
 			SSL_set_info_callback(wsi->tls.ssl, lws_ssl_info_callback);
 #endif
 
@@ -619,7 +619,7 @@ lws_tls_server_abort_connection(struct lws *wsi)
 enum lws_ssl_capable_status
 lws_tls_server_accept(struct lws *wsi)
 {
-	struct lws_context_per_thread *pt = &wsi->context->pt[(int)wsi->tsi];
+	struct lws_context_per_thread *pt = &wsi->a.context->pt[(int)wsi->tsi];
 	union lws_tls_cert_info_results ir;
 	int m, n;
 
diff --git a/lib/tls/openssl/openssl-ssl.c b/lib/tls/openssl/openssl-ssl.c
index a5e27cca0..2392822e7 100644
--- a/lib/tls/openssl/openssl-ssl.c
+++ b/lib/tls/openssl/openssl-ssl.c
@@ -200,7 +200,7 @@ lws_ssl_destroy(struct lws_vhost *vhost)
 int
 lws_ssl_capable_read(struct lws *wsi, unsigned char *buf, int len)
 {
-	struct lws_context *context = wsi->context;
+	struct lws_context *context = wsi->a.context;
 	struct lws_context_per_thread *pt = &context->pt[(int)wsi->tsi];
 	int n = 0, m;
 
@@ -291,8 +291,8 @@ lws_ssl_capable_read(struct lws *wsi, unsigned char *buf, int len)
 	lws_stats_bump(pt, LWSSTATS_B_READ, n);
 
 #if defined(LWS_WITH_SERVER_STATUS)
-	if (wsi->vhost)
-		wsi->vhost->conn_stats.rx += n;
+	if (wsi->a.vhost)
+		wsi->a.vhost->conn_stats.rx += n;
 #endif
 
 	// lwsl_hexdump_err(buf, n);
@@ -305,7 +305,7 @@ lws_ssl_capable_read(struct lws *wsi, unsigned char *buf, int len)
 		wsi->detlat.latencies[LAT_DUR_PROXY_RX_TO_ONWARD_TX] =
 			lws_now_usecs() - pt->ust_left_poll;
 		wsi->detlat.latencies[LAT_DUR_USERCB] = 0;
-		lws_det_lat_cb(wsi->context, &wsi->detlat);
+		lws_det_lat_cb(wsi->a.context, &wsi->detlat);
 	}
 #endif
 
@@ -414,13 +414,13 @@ lws_ssl_info_callback(const SSL *ssl, int where, int ret)
 	if (!wsi)
 		return;
 
-	if (!(where & wsi->vhost->tls.ssl_info_event_mask))
+	if (!(where & wsi->a.vhost->tls.ssl_info_event_mask))
 		return;
 
 	si.where = where;
 	si.ret = ret;
 
-	if (user_callback_handle_rxflow(wsi->protocol->callback,
+	if (user_callback_handle_rxflow(wsi->a.protocol->callback,
 					wsi, LWS_CALLBACK_SSL_INFO,
 					wsi->user_space, &si, 0))
 		lws_set_timeout(wsi, PENDING_TIMEOUT_KILLED_BY_SSL_INFO, -1);
@@ -439,7 +439,7 @@ lws_ssl_close(struct lws *wsi)
 	/* kill ssl callbacks, because we will remove the fd from the
 	 * table linking it to the wsi
 	 */
-	if (wsi->vhost->tls.ssl_info_event_mask)
+	if (wsi->a.vhost->tls.ssl_info_event_mask)
 		SSL_set_info_callback(wsi->tls.ssl, NULL);
 #endif
 
@@ -450,11 +450,11 @@ lws_ssl_close(struct lws *wsi)
 	SSL_free(wsi->tls.ssl);
 	wsi->tls.ssl = NULL;
 
-	lws_tls_restrict_return(wsi->context);
+	lws_tls_restrict_return(wsi->a.context);
 
 	// lwsl_notice("%s: ssl restr %d, simul %d\n", __func__,
-	//		wsi->context->simultaneous_ssl_restriction,
-	//		wsi->context->simultaneous_ssl);
+	//		wsi->a.context->simultaneous_ssl_restriction,
+	//		wsi->a.context->simultaneous_ssl);
 
 	return 1; /* handled */
 }
diff --git a/lib/tls/tls-client.c b/lib/tls/tls-client.c
index dc0e74ab1..fe9f91d89 100644
--- a/lib/tls/tls-client.c
+++ b/lib/tls/tls-client.c
@@ -87,7 +87,9 @@ int lws_context_init_client_ssl(const struct lws_context_creation_info *info,
 	const char *cert_filepath = info->ssl_cert_filepath;
 	const char *ca_filepath = info->ssl_ca_filepath;
 	const char *cipher_list = info->ssl_cipher_list;
-	struct lws *wsi = vhost->context->pt[0].fake_wsi;
+	lws_fakewsi_def_plwsa(&vhost->context->pt[0]);
+
+	lws_fakewsi_prep_plwsa_ctx(vhost->context);
 
 	if (vhost->options & LWS_SERVER_OPTION_ADOPT_APPLY_LISTEN_ACCEPT_CONFIG)
 		return 0;
@@ -149,11 +151,9 @@ int lws_context_init_client_ssl(const struct lws_context_creation_info *info,
 	 * lws_get_context() in the callback
 	 */
 
-	wsi->vhost = vhost; /* not a real bound wsi */
-	wsi->context = vhost->context;
-	wsi->protocol = NULL;
+	plwsa->vhost = vhost; /* not a real bound wsi */
 
-	vhost->protocols[0].callback(wsi,
+	vhost->protocols[0].callback((struct lws *)plwsa,
 			LWS_CALLBACK_OPENSSL_LOAD_EXTRA_CLIENT_VERIFY_CERTS,
 				     vhost->tls.ssl_client_ctx, NULL, 0);
 
diff --git a/lib/tls/tls-network.c b/lib/tls/tls-network.c
index c5ad8fb02..b1b438a42 100644
--- a/lib/tls/tls-network.c
+++ b/lib/tls/tls-network.c
@@ -61,7 +61,7 @@ __lws_ssl_remove_wsi_from_buffered_list(struct lws *wsi)
 void
 lws_ssl_remove_wsi_from_buffered_list(struct lws *wsi)
 {
-	struct lws_context_per_thread *pt = &wsi->context->pt[(int)wsi->tsi];
+	struct lws_context_per_thread *pt = &wsi->a.context->pt[(int)wsi->tsi];
 
 	lws_pt_lock(pt, __func__);
 	__lws_ssl_remove_wsi_from_buffered_list(wsi);
@@ -175,10 +175,10 @@ lws_tls_cert_updated(struct lws_context *context, const char *certpath,
 {
 	struct lws wsi;
 
-	wsi.context = context;
+	wsi.a.context = context;
 
 	lws_start_foreach_ll(struct lws_vhost *, v, context->vhost_list) {
-		wsi.vhost = v; /* not a real bound wsi */
+		wsi.a.vhost = v; /* not a real bound wsi */
 		if (v->tls.alloc_cert_path && v->tls.key_path &&
 		    !strcmp(v->tls.alloc_cert_path, certpath) &&
 		    !strcmp(v->tls.key_path, keypath)) {
diff --git a/lib/tls/tls-server.c b/lib/tls/tls-server.c
index c18f56a4a..78e7ade7f 100644
--- a/lib/tls/tls-server.c
+++ b/lib/tls/tls-server.c
@@ -44,7 +44,9 @@ lws_context_init_server_ssl(const struct lws_context_creation_info *info,
 			    struct lws_vhost *vhost)
 {
 	struct lws_context *context = vhost->context;
-	struct lws *wsi = context->pt[0].fake_wsi;
+	lws_fakewsi_def_plwsa(&vhost->context->pt[0]);
+
+	lws_fakewsi_prep_plwsa_ctx(vhost->context);
 
 	if (!lws_check_opt(info->options,
 			   LWS_SERVER_OPTION_DO_SSL_GLOBAL_INIT)) {
@@ -81,9 +83,7 @@ lws_context_init_server_ssl(const struct lws_context_creation_info *info,
 	 * give him a fake wsi with context + vhost set, so he can use
 	 * lws_get_context() in the callback
 	 */
-	wsi->vhost = vhost; /* not a real bound wsi */
-	wsi->context = context;
-	wsi->protocol = NULL;
+	plwsa->vhost = vhost; /* not a real bound wsi */
 
 	/*
 	 * as a server, if we are requiring clients to identify themselves
@@ -99,12 +99,12 @@ lws_context_init_server_ssl(const struct lws_context_creation_info *info,
 	 * allowing it to verify incoming client certs
 	 */
 	if (vhost->tls.use_ssl) {
-		if (lws_tls_server_vhost_backend_init(info, vhost, wsi))
+		if (lws_tls_server_vhost_backend_init(info, vhost, (struct lws *)plwsa))
 			return -1;
 
 		lws_tls_server_client_cert_verify_config(vhost);
 
-		if (vhost->protocols[0].callback(wsi,
+		if (vhost->protocols[0].callback((struct lws *)plwsa,
 			    LWS_CALLBACK_OPENSSL_LOAD_EXTRA_SERVER_VERIFY_CERTS,
 			    vhost->tls.ssl_ctx, vhost, 0))
 			return -1;
@@ -127,12 +127,12 @@ lws_context_init_server_ssl(const struct lws_context_creation_info *info,
 int
 lws_server_socket_service_ssl(struct lws *wsi, lws_sockfd_type accept_fd, char from_pollin)
 {
-	struct lws_context *context = wsi->context;
+	struct lws_context *context = wsi->a.context;
 	struct lws_context_per_thread *pt = &context->pt[(int)wsi->tsi];
 	struct lws_vhost *vh;
 	int n;
 
-	if (!LWS_SSL_ENABLED(wsi->vhost))
+	if (!LWS_SSL_ENABLED(wsi->a.vhost))
 		return 0;
 
 	switch (lwsi_state(wsi)) {
@@ -187,7 +187,7 @@ lws_server_socket_service_ssl(struct lws *wsi, lws_sockfd_type accept_fd, char f
 			goto fail;
 		}
 
-		if (wsi->vhost->tls.allow_non_ssl_on_ssl_port && !wsi->skip_fallback) {
+		if (wsi->a.vhost->tls.allow_non_ssl_on_ssl_port && !wsi->skip_fallback) {
 			/*
 			 * We came here by POLLIN, so there is supposed to be
 			 * something to read...
@@ -240,7 +240,7 @@ lws_server_socket_service_ssl(struct lws *wsi, lws_sockfd_type accept_fd, char f
 				 */
 				wsi->tls.ssl = NULL;
 
-				if (lws_check_opt(wsi->vhost->options,
+				if (lws_check_opt(wsi->a.vhost->options,
 				    LWS_SERVER_OPTION_REDIRECT_HTTP_TO_HTTPS)) {
 					lwsl_info("%s: redirecting from http "
 						  "to https\n", __func__);
@@ -248,7 +248,7 @@ lws_server_socket_service_ssl(struct lws *wsi, lws_sockfd_type accept_fd, char f
 					goto notls_accepted;
 				}
 
-				if (lws_check_opt(wsi->vhost->options,
+				if (lws_check_opt(wsi->a.vhost->options,
 				LWS_SERVER_OPTION_ALLOW_HTTP_ON_HTTPS_LISTENER)) {
 					lwsl_info("%s: allowing unencrypted "
 						  "http service on tls port\n",
@@ -256,7 +256,7 @@ lws_server_socket_service_ssl(struct lws *wsi, lws_sockfd_type accept_fd, char f
 					goto notls_accepted;
 				}
 
-				if (lws_check_opt(wsi->vhost->options,
+				if (lws_check_opt(wsi->a.vhost->options,
 		    LWS_SERVER_OPTION_FALLBACK_TO_APPLY_LISTEN_ACCEPT_CONFIG)) {
 					if (lws_http_to_fallback(wsi, NULL, 0))
 						goto fail;
@@ -267,7 +267,7 @@ lws_server_socket_service_ssl(struct lws *wsi, lws_sockfd_type accept_fd, char f
 
 				lwsl_notice("%s: client did not send a valid "
 					    "tls hello (default vhost %s)\n",
-					    __func__, wsi->vhost->name);
+					    __func__, wsi->a.vhost->name);
 				goto fail;
 			}
 			if (!n) {
@@ -356,7 +356,7 @@ punt:
 				lws_now_usecs() -
 				wsi->detlat.earliest_write_req_pre_write;
 			wsi->detlat.latencies[LAT_DUR_USERCB] = 0;
-			lws_det_lat_cb(wsi->context, &wsi->detlat);
+			lws_det_lat_cb(wsi->a.context, &wsi->detlat);
 		}
 #endif