Cross Domain Resource Sharing GET: 'refused to get unsafe header "etag"' from Response
Only simple response headers are exposed when using CORS. Simple response headers are defined here. ETag is not a simple response headers. If you want to expose non-simple headers, you need to set the Access-Control-Expose-Headers header, like so:
Access-Control-Expose-Headers: ETagHowever, note that I've noticed bugs in Chrome, Safari and Firefox that prevent non-simple headers from being exposed correctly. This may be fixed by now, I'm not sure.
You shouldn't need to do a preflight request, since preflight is only required for non-GET/POST http methods or non-simple request headers (and you are asking about response headers).
Have you ever tried AJAX 2.0 (Cross domain sharing) is a methodology fairly recently brought out by W3C: http://www.w3.org/TR/XMLHttpRequest2/#ref-cors
Also there is another way of doing this, which is called JSON-P, it's like a JSON request, but you can use it for cross-domains: http://en.wikipedia.org/wiki/JSONP
Both can be very dangerous to the site owners if not setup correctly though. So do be careful when using it.
[PS]Not sure if this will help : http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html