You're already checking if `email` exists above. If they've provided a user's SSA token and it's not valid, or if anything else goes wrong, you should be returning an error. I think it's really sketchy to blindly return success on any error like this.

If we really end up needing a graceful handling of an error from this endpoint, that can be done on the client side (ie. by making an extra request for the game data) or by revisiting this later.