Allow CORS, add/get friends of current user