The issue was related to the fact that the proxy responded 407 with a
Connection: close header.
Because the endPoint underlying the original connection was closed,
it should not have been used as a tunnel.
Rather, the endPoint of the new CONNECT attempt (with the proxy
credentials) must be used for the tunnel.
Also partially backported the fix for #408.