Is this session start protocol secure?
You have the classic problem of establishing a common secret key between the two parties before they begin exchanging any sensitive information. Consider Diffie-Hellman or - since you're dealing with a client/server setup and the risk of a MitM - a private key on the server side and then use public key encryption to establish the session key before communicating the password. This can be achieved with RSA, authenticated DH, ElGamal, and a few other methods.