However I notice people have realized they can set their own score with an HTTP request (I mean, it's Hacker News), maybe put in some sort of mitigation?
In my experience there is little you can do to "mitigate" that kind of thing outside of running the game completely server-side, which usually makes a tiny project into a much larger undertaking.
Recording the game start and end time server-side to perform a plausibility check of submitted score vs. time played would help, but this would require tracking individual users games, and still doesn't solve the problem entirely.