only allow user to see his friends