There's no way for a server to get a player's Friends list, or manage the player's friends list, without the player's session token. This makes things pretty hard, when it comes to sending & confirming friend request (we have to store the authoritative list of friends in a shared group, then have the client add/remove friends to keep in sync). Would be much easier (and more efficient - far fewer PlayFab calls) if we didn't have to jump through those hoops!
