toggling a favorite should use POST, not GET.

your action is neither safe (it changes the state of the DB) nor idempotent (as it is a toggle)