You are right. I went back and put CGI.pm v2.87 back in and added
a line:
$ENV{REQUEST_METHOD} = $ENV{REQUEST_METHOD} || '';

$TAINTED = substr($ENV{REQUEST_METHOD}.'',0,0);

and it works fine now.  There must be a better idiom for that added line ?