Includes an upgrade to the previous implementation that uses nbxml. In XMPP the XML stream flows at level 1 depth, but for BOSH the XML are not streams, but full XML (not partial), this means that stanza should be emitted at depth 0.
I redesigned the session context handling, previously I used servlet's session (maintained with cookies or URL params), but this is not very reliable, and some clients could have problems (e.g. browser with disabled cookies). There is also another problem, the cookies are set by sending a response with some cookie headers to the browser, this should be accounted when dealing with suspended and queued requests. Also there is a session expire mechanism for servlets, so this is to be accounted too.
For all the previous stated reasons I redesigned the session context so that would not use at all the servlet mechanism of keeping sessions. In the specification (xep-0124) it is said that "All requests after the first one MUST include a valid 'sid' attribute. The initialization request is unique in that the <body/> element MUST NOT possess a 'sid' attribute." So I create a session only when the BOSH request doesn't have a sid attribute, and then I use a concurrent retrieving map to work with previous sessions.