Fix ClassCastException on reload when using Events

During development we're seeing ClassCastExceptions like the following
when the application got reloaded (due to some change) and our EventListener
casts the Identity retrieved from event.user() to our CustomUser class:

2013-03-11 12:08:44,701 [error]  application
Unable to log user in. An exception was thrown
java.lang.ClassCastException: model.MyUser cannot be cast to model.MyUser
        at controllers.SecureSocialEventListener.onEvent(SecureSocialEventListener.java:48) ~[classes/:2.1.0]
        at securesocial.core.Events$.doFire(Events.scala:94) ~[securesocial_2.10-master-SNAPSHOT.jar:master-SNAPSHOT]
        at securesocial.core.Events$.fire(Events.scala:100) ~[securesocial_2.10-master-SNAPSHOT.jar:master-SNAPSHOT]

This happens because an outdated instance of the EventListener receives
the call - the old instance is still kept in Events.listeners (verified via
debugging/logging in our event listener).

To fix this, the listeners are now retrieved from the Registry on each
Events.fire, so that the actually registered listeners are notified.
Change the default password validator length to 8, matching the scaladoc.
Facebook login error when using the publish_stream scope

I was using the "email,manage_pages,publish_stream" scope and the facebook auth failed on the second login attempt because of the absence of the "expires" parameter on the token response.
This should fix the issue.
Thank you for the great library!
updated change log
On login/signUp redirect to the referer of the first signup/login request.

The referer is saved as original url when the login or signup page is
hit. If there's already an original url saved in the session, this is
not changed (e.g. the user might go to the login page, navigate to
signup and back again to login, then we want to keep the referer of the
first login request). To keep the request scheme/protocol, not the full
referer (including e.g. "http") is saved, but only the path and query
string. Otherwise, the user might be redirected from https back to
http and loose it's session (would not be logged in on http).

This changes the previous behaviour which used the onLoginGoTo property
to redirect the user to on login. This is now only used when no referer
was available.
If s.o. complains about this change one might change the behaviour so
that the referer is only used if no onLoginGoTo is configured.

Closes issue #157
updated change log
Isolate core from controllers

Removed all references to any object from the package controller from
core.
When necessary, traits where created, so needed or usefull calls from
core to things in the controller package (mainly TemplatesPlugin) can
still be used.
Also, some usefull configuration screens where added in the
RoutesHelper. This solves some problems that arise when overriding some
controllers but not all, as come objects use ROutesHelper searching for
a given particular Reverse controller. This string allows users to tell
RoutesHelper which controllers are going to be default.
The changes should be completely transparent for those using
securesocial already, but allows for the creation of custom flows by
overriding the default controllers.
Finally, as I was having some warning when building the project I
organized the imports in the core.java package to remove the unused
imports.