fix voting typo (not score, 'points')
fix bug, allowing mass-assignment