Authentication model of a javascript app using ajax
===

Security Gurus,

This is not a question specific about some javascript detail but I'm looking for validation that there are no obvious holes in the model that I've created. I decided to roll my own authentication routine (except for using a bcrypt to hash in the backend) which will work like this:

 1. User (browser or phonegap created native app) signs up > Json object posted using jQuery ajax to backend that uses bcrypt to handle the password and save the password user profile data
 2. Backend generates, saves and returns a token (MD5 hash)
 3. jQuery plugin stores the token to a local cookie
 4. When some request is made (post, comment, whatever but not too often) it gets the token from the cookie and adds that to the json and posts it again with ajax
 5. Backend checks that the token exists and has not expired (valid for 7 days) and if ok validates the request json data and processes the request
 6. When a token has expired a login screen is shown and credentials posted as ajax and a new token created as in step 2.

Everything goes through ssl for ajax requests and no password is stored anywhere. There is also a mechanism checking for brute force token spamming blocking the source ip temporarily if threshold exceeded. This is not a high security app but want to respect users data and make sure it's secure "enough".

I hope the question qualifies even though it's not specific and work as a reference for someone else if it will spark some discussion. I couldn't find any best practice tutorials on this particular approach.

Thanks in advance!

BR,
Timo