fixes gh-420

Problem with no explicit return in friends_controller and pattern matching in routes. I moved private methods in friends_controller to application_controller for convenience elsewhere in the future. This may cause problems as I notice @user is used in secure and insecure ways in other controllers and depends on the filter "must_be_own" to prevent users from modifying other users' information.