I am just wondering is there going to be LUA code that is marked as "sever only"? or is everything going to downloaded to the clients (thats changed)? The reason I ask is that it precludes any kind of "server password" if everything is downloaded. And also would allow anyone to "steal" or take the lua code from one server and create thier own (that could be a good or a bad thing depending on how you look at it).

I doubt they've not considered security.

An educated guess would point to Lua controlling high-level logic, which it's excellent for. The engine is merely interfaced with Lua; there's no particular reason I can think of that a client would need to run a script from the server (small precompiled Lua chunks could come in useful though, I imagine -- maybe some GUI widgets like TrackMania). It'll be pretty much the same as any other server-side modifications for other games, but this one is clearly more malleable from the start.