Thanks @deherman-MSFT for the reply and links to the sample code. I really appreciate it.
After experimenting with several SAS token creation methods, it turns out I need an extra "write" permission in addition to the "create" permission when I was creating the SAS token for the client to upload to the blob storage (only for stageBlock uploads). The change in permission list (from "c" to "cw" when calling BlobSASPermissions.parse() function) made the whole thing works for uploading both small and large files. All sample code use full permission when creating the token ("rwcadl") which does not really help in understanding how to use each permission individually, and it wasnt documented in the API doc as well.