The problem of securely transmitting a username and password is a solved problem, HTTPS is elegant and works well.
In terms of this proposal it is significantly less secure than HTTPS, because this proposed system is vulnerable to a replay attack. Who cares what the username and password actually are, if you just login with
hash(user+password), then this is the only value the attacker needs to know.
Secure hash based challenge responses usually innovate a causation where the server provides the client with a nonce, and then the
hash(nonce+hash(password)) is used. The nonce can never be reused, Microsoft's NTML has had this problem "fixed" more than once.
After you login with the username and password you still need to protect the session id, which is the authentication token sued by the browser to maintain the authenticated state, so HTTPS is a good solution for this as well.