Only treat controllers like controllers

and treat non-controller classes in controller files
as if they are modules that might contain a controller
Convert class name to string for 1.8
XSS test for controller nested inside class
Merge pull request #315 from presidentbeef/deal_with_controller_inside_class

Only treat controllers like controllers