secure browse friends controller action from bad inputs