no-param-reassign issues.
I'm sure this will be veto'd in a snap, but I was trying to avoid just disabling this eslint rule or writing them on every response.body set.

I'm wondering why it's not just `response.body(await db.getUsers())` or similar.