I think it would be better to avoid FFI for the public API.  It doesn't make for nice Lua APIs, because you can't pass a table into an FFI function and do anything meaningful with it.  Or at least that's my recollection of the luajit ffi; it's been a few years since I've used it.    But I do like the idea of being able to store state across requests