An efficient SPEKE protocol with curve25519
One small issue is that it can be detected if the x-coordinate lives on the base curve or on its twist. 


There's not a small issue; this allows a passive attacker to halve his dictionary by listening into a single exchange.

That is, if $s$ is on the curve, then so will be $s^x$; if $s$ is on the twist, so will be $s^x$.

So, what the attacker can do is listen in, and see if the exchanged $s^x$ and $s^y$ values are on the curve or not.  If they are, he can discard the half of his password dictionary that would place $s$ on the twist.  If they aren't, he can discard the half of his dictionary that places $s$ on the curve.

SPEKE can be done security based on X25519; however you can't just select $s$ arbitrarily; you have to make sure that it's consistently on the curve (or on the twist).