json auth workflow for cemerick/friend