First of all we should clarify the context where the scenario you thought is working.

Our JQuery plugin (both Silverlight or Java) works on the client side. It doesn't send any data to the web server.

The context is: 

1) the token is connect on the client side

2) the JQuery Plugin  works in the client side browser and doesn't send any data to the web server.

In this scenario the JavaScript objects are created in the browser and they are connected to the underlying PKCS#11 module that is running on the client side. If you try to create fake javascript objects they aren't connected to the underlying PKCS#11 and they cannot do any signature or something else related to the token.

The way you thought to send the authentication token to the server is very simple and very easy to hack.

In a Secure Login scenario there are two ways to make a secure authentication:

1) basic authentication with user-password

- the token contains the user and password protected by a PIN

- the user connects the token and types the PIN

- you call in javascript the Login function to verify the PIN

- if the verification succeeds you read the data object containing username and password

- you calculate the hash on the password, for example SHA1(password)

- you send your authentication token to the server:

 {
   username: <username>,
   password: <base64 hashed password>
   loginDateTime: 2014/1/1,12.00.00
   ....
}

- on the server side you check the received authentication token matching the hashed password with the one stored in the user's profile

1) strong authentication with challenge-response

- the token contains the username and the user's private key (RSA or ECC) protected by a PIN

- the server added in the web page a challenge like this (each web page will have a different challenge):

 var challenge = "<challenge>"; 

- the user connects the token and types the PIN

- you call in javascript the Login function to verify the PIN

- if the verification succeeds you read the data object containing the username and produce your own challenge

var mychallenge = "<random challenge>";

- you call the sign function on the string challenge + mychallenge to produce the response

 var signature = session.Sign("<challenge>" + "<mychallenge>"); 

- you send your authentication token to the server:

{
   username: <username>,
   clientChallenge: <mychallenge>
   signature: <base64 signature>
   loginDateTime: 2014/1/1,12.00.00
   ....
}

What you mentioned is related to any Basic Authentication, when username and hashed password is sent to the server not only the the one done by a token with NCryptoki.

To avoid from that the only solutions are Strong Authentication (via challenge-response) and OTP.