Which is then going beyond just using scrypt on the client. What you explain is simply challenge-response authentication.