I moved the hash computation code to webapp, but not using the AUTOUPDATE_VERSION in the app cache manifest turns to be a mistake.  Here's what happens:

1. The developer changes AUTOUPDATE_VERSION.
2. autoupdate causes the client to reload.
3. The browser re-downloads app.manifest.  But it hasn't changed, so the browser *doesn't* re-download the app HTML.
4. The client starts up using the old app HTML with the old value for the auto update version.  Since that doesn't match the new version it gets from the subscription, it goes into an infinite loop of reloads.

I think the solution is to have appcache have a weak dependency on autoupdate, and then include *both* the client hash and the auto update version in the manifest (when autoupdate is used).  This means the app cache can still be updated by the browser in the background when client code changes and the auto update version doesn't (and so the user will still get the new version on a manual reload), and the reload process also works.