DerbyJS is a pretty cool project. I was checking it out a while ago but there was no way to hide private data (user details etc) from the client. It seems they have made a start on that now though[0]. Might be time to take another look.

[0] https://github.com/codeparty/racer/blob/master/lib/accessCon...