Couple of points of note:
This patch doesn't interact with the native interface, which going forward in trunk would seem to be more relevant. At the least that probably means the JMX name shouldn't include 'thrift'. connections? something else.
Rather than returning error strings, probably would be better to just throw RuntimeExceptions, as programmatically you wouldn't be able to tell that "No active connection found for given host and port" wasn't a user name. Sure it looks fine in jconsole, but i'm talking about a programatic access.
Creating a ThriftSessionManager field in CassandraServer doesn't seem necessary just to make sure that it is loaded first. One would think you could just do something like
ThriftSessionManager.instance.hashCode() in the CassandraServer ctor.
When i saw the word 'Active' in the jmx names, i immediately assumed you were talking about how many clients had code running for them in the server at the present time. I'm not sure if there's a better word for what you are reporting or not. In addition, with connection pooling, these numbers maybe larger than expected, so is that statistic of use? Or do you really want active use connections?
Is there any concern about exposing user identity thru jmx? probably not, just asking.
As soon as you do expose this however, admins will want the ability to kill a specific users connection
small nit, the import order is