Add friend workflow, credential-fn, and required middleware.
Add ClojureScript-side helpers.
Update README indicating security work that needs to happen still.