Ensuring no unintended leaking before authentication
Here are my comments in no particular order:


Don't create your own crypto.
We don't analyze designs on this website because it is hard work and you shouldn't create your own anyway.
It seems that for this protocol to work the server will have to store the user password in plaintext. That seems like a bad idea.
Using this scheme will allow an attacker to brute force the user password using only the information that has been transmitted since he can validate 

auth_key = PBKDF2(password_guess, salt, cost, 768))

HMAC(cost.to_string + salt, auth_key) == auth_hash. That also seems like a bad idea.