API rejects spell cast if not enough mana

Fix #3493 “API does not validate if user has enough mana”

src/controllers/user.js

@@ -302,6 +302,7 @@ api.cast = function(req, res, next) {
   var klass = shared.content.spells.special[req.params.spell] ? 'special' : user.stats.class
   var spell = shared.content.spells[klass][req.params.spell];
   if (!spell) return res.json(404, {err: 'Spell "' + req.params.spell + '" not found.'});
+  if (spell.mana > user.stats.mp) return res.json(400, {err: 'Not enough mana to cast spell'});
 
   var done = function(){
     var err = arguments[0];