Feature/friend

Friend authentication for http basic api calls and form based for those going via the website and ajax.
``(route paths)`` would be better as ``(get paths routes)`` to avoid cryptic errors when route is not a keyword, or even worse if route is a fn.

If that's not palatable - at  least ``(assert keyword? route)``