fixed bug: user can be his own friend