Refactored the controller to go thorugh a DTO that restricts the user to only be able to update firstName, lastName, phoneNumber, adress_street, adress_zip and adress_city.
Added if-statement to check if the userId exists, if not it gives a proper response. (userId not found)
Refactored responses for adding / removing games from wishlist to a generic message.
Test in postman
Test all the endpoints, preferably with user logged in, and then admin logged in.