AdHoc SessionData should be extensible
org.jivesoftware.openfire.commands.SessionData is not final (in other words: can be extended) but its constructor (and various methods) are package protected. This makes it hard to subclass.
The access modifier to be applied should be "protected" (or something more liberal).
The "protected" access modifier was applied to the constructor and methods that had package protection.