This suggestion may tick you off, but it's only a suggestion. You may want to eventually migrate to something like CGI::Application. The way it works is that you build up the output in a run_mode and within this runmode you can change things such as what the headers will print when you're ready to go. HTTP is all text and certain things are expected to happen. Once you get beyond certain points (i.e. headers are already sent) then it's too late to send out cookies or anything else for that matter.

A short-term possibility is to move most of the logic for detecting cookies and whatnot up towards the beginning of the script. Then you just set flags for later use but use them at the beginning while printing out the headers to make certain you send everything you need.

Of course, I may be reading everything incorrectly and coming across as an idiot. If so, then I apologize as I've been up for an extraordinary amount of time.