RESTful web application security and authentication scheme

I am building a web application where the front-end is a single-page-app and the back-end serves it through a RESTful API. I want to make sure I implement user authentication with the best security practices.

I am planning a system that will perform the following steps to ensure authentication security:

Signing up (or changing password):

1. User sends username and password to server in plaintext via HTTPS


2. Unique salt is generated with Python's urandom function (32 chars)


3. Salt prepended to password


4. Salt + password is hashed with bcrypt


5. Salt and hash stored in database table (SQL database, slower than key-value but I'm not too concerned about superspeed for logging in)


6. Random session id generated with urandom (32 chars)


7. Session id stored in key-value db (Redis? Key: user id, value: session id) and sent to client along with user object (obviously without salt and hash)

Logging in:

1. When logging in, user sends username and password to server in plaintext via HTTPS


2. Server retrieves salt and hash from users entry in SQL db


3. Salt prepended to password and put through bcrypt


4. If both hashes match, session id generated with urandom and entered into key-value db


5. Session id sent to client with user object

Any other request to the server:

1. Request and data sent via HTTPS including user id and session id


2. Key-value db searched with user id, if session ids matching, return requested data along with user object


3. If not matching, return error 401

Session handling:

1. Allow more than one session for the same user


2. Set expiration of session to 24 hours, when accessed, put back to 24 hours


3. Allow persistent session which expires in 1 month, when accessed also put back to full expiration time


4. On logout, remove session from Redis

Will this be a secure, scaleable and fast (when necessary) system? If not, where are the security flaws? What could I do to improve this process?