Just wondering why you're using some flimsy client side hashing of passwords instead of using a simple SSL certificate? If someone can intercept a plain text password, you're aware they can also intercept a hashed password and use that to authenticate yeah?
Talk about over thinking a trivial thing, seems you can't even manage a login properly.