Saving data to a session
This is something I always get confused with as well!!

I would probably think it's fine where it is but if you were considering moving it I might suggest using an interface and injecting that into the controller.  That way it doesn't matter where the latest friend information is persisted and the controller remains separate from this concern.

Although this might be overkill for your situation and example of this in use might be:

public interface IFriendProvider
{
   Friend GetLatest();
   void SaveLatest(Friend friend);
}


Your controller action might then become:

public ActionResult AddFriend(FriendsContext viewModel)
  {
        if (!ModelState.IsValid)
        {                
            return View(viewModel);
        }

        // where _friendProvider has been supplied through the controller constructor
        // using DI  (See Ninject or Unity for example)
        _friendProvider.SaveLatest(new Friend()
        {
           FirstName = viewModel.FirstName;
           LastName = viewModel.LastName;
           Email = viewModel.UserEmail;            
        });         
}


Your implementation of the friendProvider would be something like:

public class SessionFriendProvider : IFriendProvider
{
   private readonly HttpContext __httpContext;

   // or instead of Context maybe the session object itself?
   public SessionFriendProvider(HttpContextBase context)
   {
      __httpContext = context;
   }

   public void SaveLatest(Friend friend)
   {
       _httpContext.Session["latest-friend"] = friend;
   }

   public Friend GetLatest() 
   {
      return _httpContext.Session["latest-friend"] ?? new Friend();
   }
}