Suggestions: sanitise only_friends param

(Let’s try to commit the whole thing this time)