title: Is it already worth to give Derby.js or Meteor a shot for an app for production with authentication?
body: <p>I started reading about <a href="http://derbyjs.com/">Derby.js</a> and <a href="https://www.meteor.com">Meteor</a> to do some research on an project I'm working on. It uses a lot of real time functionalities so they both seem handy. But I have some major concerns and am wondering if it makes sense to use them at this time.</p>
  
  <ol>
  <li>Are they yet production ready? Or are there still major security issues?</li>
  <li>Do they by now support sessions and authentication?</li>
  <li>Am I right with the assumption that by relying on frameworks that do a lot of the work you might have it easier for the simple stuff but much, much harder if it get's a bit more complicated?</li>
  <li>Am I right with the assumption, that I could achieve exactly the same effects (from a user-experience perspective) when I just use Express + Socket.io (or express.io) and that I just have to invest more time/work?</li>
  </ol>
  
  <p>At the moment I'm more drawn to Express + Socket.io and think Derby and Meteor are a bit hyped. What do you think?</p>
  
  <p>To get a better idea of what I'm planning:</p>
  
  <ul>
  <li>User authentication is needed</li>
  <li>Complex routing is needed</li>
  <li>SEO is an issue</li>
  <li>Full Text Search using Elasticsearch </li>
  <li>DB probably MongoDB</li>
  <li>Complex relations between objects</li>
  <li>Realtime updates (Socket.io)</li>
  <li>Security is an issue</li>
  <li>Performance and scalability are issues.</li>
  </ul>
  
  <p><strong>Thanks!</strong></p>