Users can create friendships with posters, and then message them

shouldn't this be scoped to the user? Currently this will return a friendship that doesn't belong to this user.