I think if the request is for friends only, it would be safe to increase the limit to the number of friends the user has. Worst case, you're loading N results where N is the number of friends the user has. Assuming there's a cap on that, the efficiency of this won't get out of control.