How to enforce that only logged in user can invoke a REST API call?

I am using is spring-mvc with spring security . For security ,I am using jwt tokens coming in request headers to verify the authenticity of clients.

I have to expose an API , that will allow the user to send a "follow" request. My current API looks like below

@RequestMapping(value = "/api/follow/{userProfileId}" ,method=POST)
    public ResponseEntity<Integer> follow(@PathVariable("userProfileId")
    Long  userProfileId , @RequestBody IdWrapper idWrapper) {

        //userProfileId , user to whom request is being sent
        //IdWrapper contains the ID of the user who is sending the 
        //follow request
        System.out.println("sending interest to "+userProfileId);

        //business logic 
        return new ResponseEntity<Integer>(0,HttpStatus.OK);;
    }

So far so good, but what if some client finds out the api-url and constructs a api call with some other id as IdWrapper , not his own Id. That would mean user 1 can send a follow request to user 3 on behalf of user 2.. I think the essence of REST is to be stateless, but how do i solve this problem, without tracking the state . How are such problems tackled in REST ?