Support friends endpoint

@leahsteinberg 
this doesn't really test that friends are in the same order as the JSON response. Maybe check `firstObject` and `lastObject`?