add locking logic to UserFriendsService