Feature/friend

Friend authentication for http basic api calls and form based for those going via the website and ajax.
I believe that user_id was supposed to be different from the username, and we wanted to store user_id alongside each new resource created by the user. But at the moment user_id and username are the same, so this is redundant.