Earlier quoted context omitted.
It looks like a post request with an authenticity token that never changes during the session, so you can just post a new request with the same authenticity_token and invite_id, but with any value for new_score :)
you're right. honestly we didn't try at all to make it difficult to hack. figured that no matter what we did, anyone with decent skills should be able to hack it. after all you can see all the source code! (like jerry said in another comment, we're not a gaming company after all - it was just a fun little experiment) - excites me that it piqued people's interest enough to go poke around in the source code though! :)
Looking at how this worked was quite interesting. I hadn't really played with the JS console before. Thanks for making a contest that wasn't totally secure. =)