Removed console.log call in API
Prevented injection by parsing highscore as integer