It sounds like you're running your script through perl (i.e., executing 'perl formtest.cgi'), rather than executing formtest.cgi directly. This can be reproduced with the following code:

#!/usr/bin/perl -T
print "Test\n";
[download]

This script will give the same error you report if run as 'perl foo.pl' (with the code saved as foo.pl), but will run ok if the executable bit is set and the script is run as foo.pl
If run as 'perl foo.pl', perl doesn't start the taint checking until it reaches the -T in the shebang line, at which point perl cannot be certain that the previous part of the script isn't tainted.