Feature/friend

Friend authentication for http basic api calls and form based for those going via the website and ajax.
should be ^private