AS3 URLLoader.load not working

I have a Flash app that I use to capture a webcam pic and save the image to a server database using classic ASP. I used to use NavigateToURL. Since the recent security updates (I'm testing with Flash 14.0.0.145) I've switched to URLLoader.load. It works on my local test environment, but does not work on the QA server at the client site, that is, the ASP doesn't receive the data and the photo isn't stored in the DB (I have absolutely NO ACCESS to the customer's server).

• It is NOT cross-domain. The Flash swf is on the same server/same domain as the page I'm loading to.
• Load fires the completeHandler, and I don't get any errors (but loader.data is blank; not sure what to look at to see number of bytes sent???)
• In the ASP page, I tried storing Request.TotalBytes to see if I'm getting anything but it doesn't work (no database entry is made).

Ideas for things to try, solution?

Code:

function UploadImage(e:MouseEvent):void {
  var previewW:int = 94;
  var previewH:int = 118;

  var CropRectX:int = CropRect.x + 83; 
  var CropRectY:int = CropRect.y + 28.5; 

  //create a bitmap the size of the crop box
  var croppedBD:BitmapData = new BitmapData(CropRectCurrWidth, CropRectCurrHeight, false, 0x0000CC44);
  //create a rectangle relative to the cropbox in the video pane
  var rect:Rectangle = new Rectangle(CropRectX, CropRectY, CropRectCurrWidth, CropRectCurrHeight);

  var pt:Point = new Point(0,0);
  //copy the pixels from the crop area to the new bitmapData object
  croppedBD.copyPixels(cameraCaptureBD, rect, pt);


  var jpgEncoder:JPGEncoder = new JPGEncoder(100); // argument is the quality parameter

  var jpgStream:ByteArray = jpgEncoder.encode(croppedBD);

  //source: http://stackoverflow.com/questions/597947/how-can-i-send-a-bytearray-from-flash-and-some-form-data-to-php
  var loader:URLLoader = new URLLoader();
  configureListeners(loader);
  var header:URLRequestHeader = new URLRequestHeader("Content-type", "application/octet-stream");
  var request:URLRequest = new URLRequest(SaveURL);  //value: "SavePhoto.asp"
  request.requestHeaders.push(header);
  request.method = URLRequestMethod.POST;
  request.data = jpgStream;

  try 
  {
  loader.load(request);


  try 
  {
  navigateToURL(new URLRequest(DoneURL), "_top");  //DoneURL = "PrintPassesFrame.asp#" & [passID Num]


  } catch (error:Error) 
  {
  msg.text = msg.text + error.message;
  }

  } catch (error:Error) 
  {
  msg.text = msg.text + error.message;
  }

         function configureListeners(dispatcher:IEventDispatcher):void {
            dispatcher.addEventListener(Event.COMPLETE, completeHandler);
            dispatcher.addEventListener(Event.OPEN, openHandler);
            dispatcher.addEventListener(ProgressEvent.PROGRESS, progressHandler);
            dispatcher.addEventListener(SecurityErrorEvent.SECURITY_ERROR, securityErrorHandler);
            dispatcher.addEventListener(HTTPStatusEvent.HTTP_STATUS, httpStatusHandler);
            dispatcher.addEventListener(IOErrorEvent.IO_ERROR, ioErrorHandler);
        }


         function completeHandler(event:Event):void {
            var loader:URLLoader = URLLoader(event.target);
  msg.text = msg.text + "completeHandler: " + loader.data;
    
            var vars:URLVariables = new URLVariables(loader.data);
  msg.text = msg.text + "The answer is " + vars.answer;

        }


         function openHandler(event:Event):void {
  msg.text = msg.text + "openHandler: " + event;
        }


         function progressHandler(event:ProgressEvent):void {
            trace("progressHandler loaded:" + event.bytesLoaded + " total: " + event.bytesTotal);
  msg.text = msg.text + "progressHandler loaded:" + event.bytesLoaded + " total: " + event.bytesTotal;
        }


         function securityErrorHandler(event:SecurityErrorEvent):void {
  msg.text = msg.text + "securityErrorHandler: " + event;
        }


         function httpStatusHandler(event:HTTPStatusEvent):void {
  msg.text = msg.text + "httpStatusHandler: " + event;
        }


         function ioErrorHandler(event:IOErrorEvent):void {
  msg.text = msg.text + "ioErrorHandler: " + event;
        }
}