I think you're going a quite roundabout way to filling in the form using WWW::Mechanize. WWW::Mechanize itself takes care of sending a correct Referer header, and you can fill in a form directly if you know the fields that are on it:

# Select the login form
$mech->form_with_fields('user_name','user_pass');
$mech->set_fields( user_name => 'username', user_pass => 'secr1t' );
$mech->click('login');
print $mech->content;
[download]