The API to update user properties is not safe from concurrent updates, as the object returned when checking the preconditions for the update may not be the same object that is updated. To ensure the update is performed correctly, the object must be protected with a unique entity tag.

Acceptance criteria:

• Extend the user object with an ETag property

  • The property needs to uniquely identify an object of a given user

• Protect the user update by adding the etag to the update filter.

NOTE: This task is not about extending the API, it's only about protecting the API handler.