If you're determined to do this on your own, it's going to be something like this:

if ($usr eq 'admin' && $pwd eq 'admin') {
$cookie = ...;
#inside content
print "Content-Type: text/html\r\n";
print "Set-Cookie: login="$cookie"\r\n\r\n";
...
}
[download]

The client will send a Cookie header on subsequent requests. You have a lot of choices about what exactly to put in $cookie. You might use something like this:

my $cipher = Crypt::CBC->new(-key=>$secret_key, -cipher => 'Rijndael')
+;
my $cookie = MIME::Base64::encode_base64($cipher->encrypt("$usr:$pwd")
+, '');
[download]

..assuming the user name doesn't include colons.