web/src/main/java/org/springframework/security/web/csrf/HttpSessionCsrfTokenRepository.java
public void saveToken(CsrfToken token, HttpServletRequest request,
			HttpServletResponse response) {
		if (token == null) {
			HttpSession session = request.getSession(false);
			if (session != null) {
				session.removeAttribute(this.sessionAttributeName);
			}
		}
		else {
			HttpSession session = request.getSession();
			session.setAttribute(this.sessionAttributeName, token);
		}
	}
public void saveToken(CsrfToken token, HttpServletRequest request,
			HttpServletResponse response) {
		if (token == null) {
			HttpSession session = request.getSession(false);
			if (session != null) {
				session.removeAttribute(this.sessionAttributeName);
			}
		}
		else {
			HttpSession session = request.getSession();
			session.setAttribute(this.sessionAttributeName, token);
		}
	}
/*
(non-Javadoc)

@see org.springframework.security.web.csrf.CsrfTokenRepository#saveToken(org.
springframework .security.web.csrf.CsrfToken,
javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)