Payments with a cvv_response_message are not necessarily risky.
Remove defunkt spec that's no longer true.