abstract out DB calls in `POST /games` controller (fixes #265)