Part of the reason I (in a C++ app) did it this way was specifically so the password was never sent on the wire and was immediately zero'd in memory after sending.

The problem with such a protocol is that the hash of the "password" effectively is the password. That is, the server requires the client knows H(password + salt) to login (call this the "pass token"). While the password is not sent over the wire, the pass token is. If there was a flaw in the cryptography such that I can view the data on the wire, then I can see and replay the pass token to gain access. Note I do not need to brute force the pass token to do this!
[/quote]
My apologies, I revisited the code to make sure about this and I realized that I was actually sending the username+password under encryption. Guess I had already considered what you mention and fixed it but forgot about it. Oops.

As to the rest of it, I completely agree, this is not a web app of course and salsa was chosen for performance reasons and not for the ultimate security.