I realize it may be more performant this way, but do we really want to have a `game` parameter here? I think it would be safer and cleaner to instead take a `gameID` parameter and fetch the game data using `getGameFromID`, like `updateUser` does in `user.js`. This way there's no risk of `game` containing unwanted changes (ie. in case somebody erroneously modifies the `game` object directly and then calls this method).