Add @restrict_access to (un)friend.

We must be logged in with user/pswd to run (un)friend methods.