REST best practice get /articles for guest and for auth?

I've read that Get requests should be idempotent. I'm making an android app with a list of articles. Both guest and authenticated users can view a list of articles, but authenticated also get favorited status.

To make a request idempotent, the authenticated user should request both /articles and a second request to get the favorite status of this article.

How professional developers make these things? What is the best practice?

I see 3 ways:

1. Return a combined result based on the user. for guests favorited: 0, for authenticated if favorited, favorited: 1

GET /articles (statefull)

[
   {
      "id":1,
      "title":"First Article",
      "favorited":1
   },
   {
      "id":2,
      "title":"Second Article",
      "favorited":0
   },
   {
      "id":3,
      "title":"Third Article",
      "favorited":1
   }
]

2. Return stateless and make ​additional request to check the favorited status for this article ids if authenticated.

GET /articles (stateless)

[
   {
      "id":1,
      "title":"First Article"
   },
   {
      "id":2,
      "title":"Second Article"
   },
   {
      "id":3,
      "title":"Third Article"
   }
]

if authenticated get favorite statuses for article id 1, 2 and 3
GET /favorites?id=1,2,3

[
   {
      "id":1,
      "favorited":1
   },
   {
      "id":2,
      "favorited":0
   },
   {
      "id":3,
      "favorited":1
   }
]

3. Return stateless. After login user need to request endpoint to get all favorited ids, save them in the local client, and on every item display check from local if post id is favorite. Note some users have 300+ favorited articles

After login get all favorited ids, save in client.

GET /myFavoriteArticleIds

[
   1,
   3,
   5,
   9,
   17
]

And then make stateless requests
GET /articles (stateless)

[
   {
      "id":1,
      "title":"First Article"
   },
   {
      "id":2,
      "title":"Second Article"
   },
   {
      "id":3,
      "title":"Third Article"
   }
]

from REST best practice get /articles for guest and for auth?