Any user can delete any other user's relationships

Any user can delete another user's relationships if they know (or guess) the rid. The callback for removing relationships doesn't check to make sure the user is authorized.

Here are steps to reproduce. Let's call our friendly users Alice and Bob, and our attacker Eve.

1. Log in as Alice, and request a relationship with Bob
2. Log in as Bob, and approve that relationship
3. View Bob's relationships page, and copy the Remove link URL onto the clipboard. It will be something like:
   https://example.com/site/user/2/relationships/remove/128?destination=relationships; in this example, the 2 is Bob's UID, and the 128 is the rid
4. Now log in as Eve, and note Eve's UID.
5. Paste the URL from step 3 into your browser URL bar, and change the UID (the part between user and relationships) to Eve's. Visit that page.
6. Eve will see a page saying Are you sure you no longer wish to be a friend of Alice?
7. Click on the Yes button
8. Eve will see a message that she is no longer a friend of Alice, but actually she has removed the friendship between Alice and Bob!
9. Log in as Alice, and note that your friendship with Bob has been deleted.
10. Log in as Bob, and note that your friendship with Alice has been deleted.

I have not tested it, but I suspect a similar problem exists when disapproving relationships, and cancelling pending relationships.

Is there some configuration option I'm missing to prevent this? Otherwise I'll see if I can put together a patch.