phildeman, I'm relatively new to sessions, but have recently got some scripts running, first with CGI::Sessions and then with the amazing CGI::Application and one of it's many plugins: CGI::Application::Plugin::Session. Here's a snippet of both approaches:

SET SESSION:

use CGI qw/:cgi/;
use Data::Dumper;
use CGI::Session;
my $query = new CGI;

my $session = new CGI::Session("driver:File", $query, {Directory=>'/tm
+p'});

$session->param('user_id',$query->param('user_id'));
$session->param('user_name',$query->param('user_name'));
$session->param('logged-in',1);
$session->expires("+15m");

my $cookie = $query->cookie(CGISESSID => $session->id );
print $query->header(-cookie => $cookie);
[download]

GET SESSION:

my $session_id = cookie('CGISESSID');
my $session = new CGI::Session("driver:File", $session_id, {Directory=
+>'/tmp'});

if ( !$session->param('logged-in') ) {
   print "Your session expired.";
   exit(0);
} else {
   my $user_id    = $session->param('user_id');
   my $user_name = $session->param('user_name');
}
[download]

WITH CGI::APPLICATION::PLUGIN::SESSION

use base 'CGI::Application';
use CGI::Application::Plugin::Session;

sub cgiapp_init {
   my $self = shift;
   $self->session_config( DEFAULT_EXPIRY   => '+15m');   
}

sub cgiapp_prerun {
   my $self = shift;

   if ($self->session->param('logged_in')) {   
      $user_id   = $self->session->param('user_id');
      $user_name = $self->session->param('user_name');
   } else {
      $self->prerun_mode('login');
   }
}

sub setup {
   my $self = shift;
   $self->mode_param('rm'); 
   $self->run_modes(
    'login'   => 'log_in'
    );
}

sub set_session {
   my $self = shift;
   $self->session->param(user_name  => $user_name);
   $self->session->param(user_id    => $user_id);
   $self->session->param(logged_in  => 1);
}
[download]

Caveat: this exact code not tested