api now checks to make sure the authd user and the requested user are friends