Consider sandboxing lua scripts and sending them over to the clients when they join a server.
This makes it far easier to host a server since we wouldn't need to make sure all clients have the same mods.
Servers would only send over things like...
- tiled data
- images
- sounds
- json
- sandboxed lua
file validation may be necessary