My load test shows that when max_sessions is reached, new clients are rejected, but only after they've connected and completed TLS handshake.

This is not ideal as it still puts load on the LS...