Or cookies. 4 kB is a lot of friends. Invalidate them every time someone adds a friend.

Both of these however make cache invalidation (in case of multiple browsers/computers) hard—nearly impossible even.