Overuse of the private methods?

[michalsn]

Aren't we overusing private methods a bit? I'm trying to extend the Authentication\Authenticators\Session class and I can't use general session-related methods such as: getSessionKey(), setSessionKey(), etc. because they are all private. Of course, I can create my own methods to do what I want, but it seems strange when these methods already exist.

[kenjis]

We are using private to avoid breaking changes or not to add new APIs.
If you believe something should be protected, send PRs.