Remove Servlet 2.5 and 3.0 Support for Remember Me

[jzheaux]

Related to #6220

The AbstractRememberMeServices attempts to use the setHttpOnly method only if that method is available in javax.servlet.http.Cookie.

Since Spring Framework 5.0 has a Servlet Spec baseline of 3.1, this check is no longer necessary.

We should always use the setHttpOnly method and remove any corresponding Servlet 2.5 or 3.0 tests.

[studyforbetter]

can you tell me how to use it by xml configer ,

[jzheaux]

@studyforbetter there isn't anything special to do for XML in this case. CookieCsrfTokenRepository is configured by both the Java config as well as the XML config in the same way.

[dongmyo]

@jzheaux I'd like to take it

[jzheaux]

@dongmyo It's yours