refactored and more restful, need restrictions on friendship#show