Follow/Unfollow should be GET, not POST

Mistake in API conversion
Require authkey header to make requests

This prevents cross-site control of the API