Consider sandboxing lua scripts and sending them over to the clients when they join a server.
This makes it far easier to host a server since we wouldn't need to make sure all clients have the same mods.

Servers would only send over things like...

• tiled data
• images
• sounds
• json
• sandboxed lua

file validation may be necessary