It looks like a post request with an authenticity token that never changes during the session, so you can just post a new request with the same authenticity_token and invite_id, but with any value for new_score :)
The obvious flaw with this is people who just work out what your maximums are and then get the 100% score, but it discourages the ridiculous scores.
edit: one of your people said this below, disregard :-)