removed auth from friends controller