check user friends permissions