AES Secure key generation and storage
In practice you should use the tools already provided.  SSL/TLS and by extension HTTPS are very powerful tools that provide proper implementations of key exchange, authentication and privacy.  As far as I can tell this solves all of your problems.

AES-CBC alone is problematic.  As Thomas pointed out you lack authentication.  A common solution to this problem is using an HMAC and here is a good discussion of HMACs and encryption.