If we want to set permissions on certain urls, how would you change it to only friends (not just any users)?
MonoX doesn't support this out of the box. This would require you to implement custom security checks on your pages. Please let us know if you require a few ideas on how to implement this.
Also, are there permissions to web controls that can be set up?
You can set view permissions on certain roles.