> I am trying to come up with a way to implement token-based authentication for a REST API without the need for SSL.

Don't!

**Use SSL (well, TLS actually).**

> nothing that isn't public already is going over the wire 

This is obviously false: 
- the user name is captured; TLS would hide user name
- `hash(salt,password)` is captured and passwords can now be tried (dictionary attack).

> I have only started looking at security therefore pretty much a novice at this stuff so any help/advice would be appreciated!

**Use the proper tools. Don't try make your own protocols.** If you try to come up with your own security protocols, they will almost always be flawed.

There are many issues with your protocol:

- discloses user name (might not be huge issue, but still)
- discloses password hash: **allows off-line attack on password**
- the server needs to know all **passwords in clear-text** (either by storing them in clear-text, or storing them encrypted with symmetric encryption, and storing the encryption key)
- and the worst part: **absolutely no protection against an active attacker**