Feature/friend

Friend authentication for http basic api calls and form based for those going via the website and ajax.
worth checking what the default response type will be in case the user doesn't specify an Accept header.