When you go to a persons page, you click "follow" and then they are your friend. I think these should be two separate things. I can follow anyone, but a separate request should be made to be there friend, and that request should require confirmation from the user.