Here are some more interesting news:
When Avast is turned off a TCP packet sniffer reveals the first packet in a HTTP post is 881 bytes and consists of the a complete HTTP header for the HTTP POST operation. The rest of the upload data come in 1518 size TCP packages until upload completed.
When Avast Sheild is turned on and XML data uploaded is reasonably small 150kB or so - Avast stream data out in TCP packets all being of 1518 byte size. That makes the HTTP header have some company followed by XML data in the first TCP package.
The veird thing is when the XML data in the POST is larger like 300kB the first and only TCP package on the AVAST output stream is 881 bytes long and then silence.
It looks like when Avast processes larger amount of data it gets to the first input stream TCP block and streams that out while the rest is lost, blocked or similar. Receiving server complains on the HTTP level after 30 seconds with error 500 as no more data was received. The TCP connection remains open until droped after 2 minutes with no more data sent.
Typical first TCP block data:
POST /ode/projects HTTP/1.1
Host: code.appinventor.mit.edu
Connection: keep-alive
Content-Length: 291796
X-GWT-Module-Base: http://code.appinventor.mit.edu/ode/
X-GWT-Permutation: 94451607BB03FFFDB75CEAD85043BCBF
Origin: http://code.appinventor.mit.edu
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36
Content-Type: text/x-gwt-rpc; charset=UTF-8
Accept: */*
Referer: http://code.appinventor.mit.edu/?locale=en
Accept-Encoding: gzip, deflate
Accept-Language: sv-SE,sv;q=0.8,en-US;q=0.6,en;q=0.4,nb;q=0.2,de;q=0.2
Cookie: G_ENABLED_IDPS=google; _ga=GA1.2.1634098852.1504264096; AppInventor=..