Socket.IO on Heroku does NOT work without SSL

I have a chat server setup as such:

var port = Number(process.env.PORT || 5000);

var app = require('http').createServer(handler)
  , io = require('socket.io').listen(app, {'log level':1, 'match origin protocol':true})
  , fs = require('fs')


io.set('authorization', function (handshakeData, callback) {
  console.log(handshakeData);
  callback(null, true);
});

and then I handle some events:

io.sockets.on('connection', function(socket) {

  socket.emit('handshaken', {id:socket.id}); // for HTML clients

  socket.on('subscribe', function(roomId) {
    doSubscribe(socket, roomId);
  });

  socket.on('unsubscribe', function(roomId) {
    doUnsubscribe(socket, roomId);
  });

  socket.on('chat', function(data) {
    doChat(data);
  });
});

The client is on a different domain.

When I use the chat server via https, then everything is working fine. All the events are received. However, when I use http, I can see that the client can receive the 'handshaken' event, but nothing else is sent or received. I wonder if this has anything to do with the socket.io authorization not working properly with non ssl connection.

However, in local environment, I can still use non ssl http://localhost:5000 as the chat server url without any issue. Is it also possible that this is an issue with Heroku?

UPDATE 1: After some investigation, if I use http url for the chat server, the server can emit to the client. The client can connect to the server, but cannot emit anything to the server (the server does not receive any emit).

Update 2: Some further investigations revealed that the chat server, under http, does received an emit, but only 1 emit. Any emit after that is not received.

It turned out that Sophos antivirus for Mac is the culprit here. After I disabled all web protection, my chat app works fine. The interesting point here is that Sophos only targets Chrome browser, as Firefox and Safari work without any problem.