moved all attack logic to model, bugfix: attacking a user who's moved throws an error