pass friend's authenticate middleware options at call site
add auth test for logging out