Add auth check in FriendController