The caller's accepted friends (each entry names the OTHER user; paginated)

Authenticate every request with Authorization: Bearer <token> — a JWT or API token.