adding cancan - editing permissions to show users only the friends they added