Remove Servlet Spec 2.5 and 3.0 Support for CSRF #6262
Description
Related to #6220
The CookieCsrfTokenRepository attempts to use the setHttpOnly method only if that method is available in javax.servlet.http.Cookie.
Since Spring Framework 5.0 has a Servlet Spec baseline of 3.1, this check is no longer necessary.
We should always use the setHttpOnly method and remove any corresponding Servlet 2.5 or 3.0 tests.