Good point (that js could be evaluated on client side as well). Although someone else said the template scripts need access to the database, and Lua can run in the browser as well (via emscripten for instance).
Via emscripten you have to download 2mb of javascript and it's slow as molasses.
Via the other "best" solution, which compiles lua to javascript, you don't get the whole language, or access to any native libraries you might be linking to.
