very good catch - only reason I can confirm this is because I installed a packaged app from the Marketplace: "Test WebAPI Permissions." I don't see any `etag`s in any other apps checked into gaia.