You have used the APP ACCESS TOKEN in your url which can not understand the meaning of /me
.
You have to use the USER ACCESS TOKEN, that will be corresponding to the user in session and then you can use /me
If you want to use the App Access Token, you have to query like this:
https://graph.facebook.com/<user-id>/friends?access_token=APP_ACCESS_TOKEN
and that too is only valid if the <user-id>
has once authorized your app.
You can read more about Access Tokens here.