you shouldn't use 'in' with locate("string"). It only works the way you think it does when used with locate(/type/path)
instead just:
var/mob/target = locate(href_list["follow"])
//then check we've been given a valid mob,
if(!ismob(target)) return