Fixed security hole and already-friend check