Opa has always treated security very carefully, as it was one of the original project goals.
Strong static typing + the original native backend makes Opa one of the best candidates for secure web app. We're not vocal about this, but the company behind Opa has customers in the defense sector (in Europe, PRISM totally unrelated) for this reason.
By security, I mean user permissions... ex: User A can't edit records beloning to User B, but Manager C can see them both, and Admin D can see everything.
Many of these "Simple" frameworks that transparently pass stuff to the client-side forgo roles, accounts and ownership hierarchies.
In Opa, you have too mechanisms that combined provide probably a very high level of security in this sense too:
1) Algebraic constructs, so that the typing system checks properties like permissions automatically
2) Client "guards", aka protected values that can't be transmitted to the client, which Opa checks automatically.
If you really want one toolkit to rule them, you could go with GWT, which is close... there are also up and coming frameworks using NodeJS, MongoDB etc... (like this one, Meteor, and Derby). It really depends... the problem is, "it's complicated"... You have frameworks with very few assumptions like Backbone, and you have frameworks with a LOT of assumptions... you have two-way binding or manual events.
The more "automagic" a framework is, the harder the edge cases get. For me, I've been leaning towards JS on the server, as you at least get rid of a lot of context switching. I know a lot of the guys coming from Ruby and Python tend to favor CoffeeScript, to be honest, other than writing configurations and tests, I don't like it as much.
The really funny thing is that E4X is already a standard, submitted by Mozilla years ago, that would act as an extension to the regexp parsing, and be a good fit for this. Unfortunately, the core V8 guys refuse to support it, and MS likely never would either. So we're stuck with string processing hacks, or abusing the DOM for these types of interactions.
I do like that Opa offers some more natural DB interactions... I think security implications get complicated as well, which is what makes me a bit fearful of these types of frameworks for any serious, public facing applications.