add ability to set extra params to oauth2 url endpoints

Co-authored-by: Benjamin Sellers <bsellers@gmail.com>
Support redirects to /login (triggered by SecuredAction) to use SSL

The ssl setting is used for the form action of the login page, and in
some other places. It might also be desirable to serve the login page
already using ssl (just to show users that they're already using ssl
and thus the login should also be secure).

Direct links to the login page are under the control of the application
and can be set accordingly. SecuredActions also redirect to the login
page, in the case of missing authentication, and in such a case it should
also be possible to switch/redirect to ssl.

This commit adds a new configuration property 'useSSLForLoginPage'
that is evaluated by SecureAction handlers (both scala and java). This
property can be seen as an extension of 'ssl', because it's an additional
requirement. Because of this, redirections to ssl are only done if
both ssl and useSSLForLoginPage are set to true.
Fix ClassCastException on reload when using Events

During development we're seeing ClassCastExceptions like the following
when the application got reloaded (due to some change) and our EventListener
casts the Identity retrieved from event.user() to our CustomUser class:

2013-03-11 12:08:44,701 [error]  application
Unable to log user in. An exception was thrown
java.lang.ClassCastException: model.MyUser cannot be cast to model.MyUser
        at controllers.SecureSocialEventListener.onEvent(SecureSocialEventListener.java:48) ~[classes/:2.1.0]
        at securesocial.core.Events$.doFire(Events.scala:94) ~[securesocial_2.10-master-SNAPSHOT.jar:master-SNAPSHOT]
        at securesocial.core.Events$.fire(Events.scala:100) ~[securesocial_2.10-master-SNAPSHOT.jar:master-SNAPSHOT]

This happens because an outdated instance of the EventListener receives
the call - the old instance is still kept in Events.listeners (verified via
debugging/logging in our event listener).

To fix this, the listeners are now retrieved from the Registry on each
Events.fire, so that the actually registered listeners are notified.
do not prevent login on missing google profile info

The documentation[1] does not seem to mention it, but at least given_name and
family_name are sometimes not supplied by the userinfo endpoint.

[1] https://developers.google.com/accounts/docs/OAuth2Login#userinfocall
Use ssl property to determine, if redirects to login shall switch to ssl.
On login/signUp redirect to the referer of the first signup/login request.

The referer is saved as original url when the login or signup page is
hit. If there's already an original url saved in the session, this is
not changed (e.g. the user might go to the login page, navigate to
signup and back again to login, then we want to keep the referer of the
first login request). To keep the request scheme/protocol, not the full
referer (including e.g. "http") is saved, but only the path and query
string. Otherwise, the user might be redirected from https back to
http and loose it's session (would not be logged in on http).

This changes the previous behaviour which used the onLoginGoTo property
to redirect the user to on login. This is now only used when no referer
was available.
If s.o. complains about this change one might change the behaviour so
that the referer is only used if no onLoginGoTo is configured.

Closes issue #157
Facebook login error when using the publish_stream scope 

I was using the "email,manage_pages,publish_stream" scope and the facebook auth failed on the second login attempt because of the absence of the "expires" parameter on the token response.
This should fix the issue.
Thank you for the great library!
fixing .get on possible Nones in FoursquareProvider
Merge pull request #204 from thesmith/master

Foursquare avatars can be None and cause NoSuchElementException in FoursquareProvider
updated change log
Merge pull request #185 from chazmcgarvey/google-optional-userinfo

do not prevent login on missing google profile info
Merge pull request #177 from magro/use-ssl-for-login-page

Support redirects to /login (triggered by SecuredAction) to use SSL
Merge pull request #182 from magro/fix-event-listeners-leak

Fix ClassCastException on application reload (dev mode) when using Events
Change the default password validator length to 8, matching the scaladoc.
Merge pull request #212 from wsargent/fix-password-length

Change the default password validator length to 8, matching the scaladoc.
Merge pull request #189 from fedefrappi/patch-1

Facebook login error when using the publish_stream scope
updated change log
Merge pull request #186 from magro/157_redirect-to-referer-on-login

On login/signUp redirect to the referer of the first signup/login reques
updated change log
Add StreetLend.com to list of sites using SecureSocial

StreetLend.com http://www.streetlend.com/ is a website I created to help neighbours lend things to each other. It uses SecureSocial for authentication.