Authentication system using AJAX
Do all URLs on your site use SSL? If not you'll need to setup your site to at least support the authenticate URL over HTTPS.
Currently your passing a plain text Username and Password - anyone can grab them.

On requests after the login, how are you determining whether or not the user is authenticated?
It does not look like you are persisting the login in any way, unless Auth class is doing it behind the scenes.  Typically this is done with a session variable or cookie.