diff --git a/src/server/api.coffee b/src/server/api.coffee
index 08ec4cb11c..3ba6227217 100644
--- a/src/server/api.coffee
+++ b/src/server/api.coffee
@@ -54,8 +54,9 @@ router.get '/user', auth, (req, res) ->
   user.stats.maxHealth = 50
 
   delete user.apiToken
-  delete user.auth.hashed_password
-  delete user.auth.salt
+  if user.auth
+    delete user.auth.hashed_password
+    delete user.auth.salt
 
   res.json user
 
@@ -186,8 +187,12 @@ scoreTask = (req, res, next) ->
   delta = scoring.score(model, taskId, direction)
   result = model.get ('_user.stats')
   result.delta = delta
-  res.send(result)
+  res.json result
 
+###
+  POST /user/tasks/:taskId/:direction
+###
+router.post '/user/task/:taskId/:direction', auth, scoreTask
 router.post '/user/tasks/:taskId/:direction', auth, scoreTask
 
 module.exports = router
diff --git a/test/api.mocha.coffee b/test/api.mocha.coffee
index e243322bd9..ce25d0f99d 100644
--- a/test/api.mocha.coffee
+++ b/test/api.mocha.coffee
@@ -271,3 +271,16 @@ describe 'API', ->
           expect(res.statusCode).to.be 400
           expect(res.body.err).to.be 'No task found.'
           done()
+
+    it 'POST /api/v1/user/task/:id/up', (done) ->
+      tid = currentUser.habitIds[0]
+      request.post("#{baseURL}/user/task/#{tid}/up")
+        .set('Accept', 'application/json')
+        .set('X-API-User', currentUser.id)
+        .set('X-API-Key', currentUser.apiToken)
+        .send({})
+        .end (res) ->
+          expect(res.body.err).to.be undefined
+          expect(res.statusCode).to.be 200
+          expect(res.body).to.eql { gp: 1, exp: 7.5, lvl: 1, hp: 50, delta: 1 }
+          done()