+1 At apitools.com we use openresty as well. We chose lua (over javascript) because it's super fast, and because it has good sandboxing/ isolation properties which make it safe to handle arbitrary middleware.