Ok, that's pretty much escrow!

However, there is always the issue of you contacting Avalon and claiming that your account was hacked into. Is there any documentation or confirmation that they will honor an address change or the release of your account to another party? If not, I would contact Avalon and ask them to give you clarification. I would also allow John K to take full ownership over the account after he has received the full payment. That would eliminate any possibility of you changing the login info right after you recieve the BTC(I'm not claiming you would do that). This would just ensure everything is controlled by the escrow.