We've had more success with putting it in the command line parameters than in the config file. Also JamminR was correct. You will need to make sure you send the client all client based lua scripts you wish for them to be able to use as SE blocks all client lua not sent from the server.
It IS very buggy and should not be used as a end-all to hacking/exploiting. Nothing can ever replace the watchful eye of an administrator.