my $op = $query->param('option') || 'Login';

if ($op =~ /^(\w+)$/)
{
  # this is good for untainting.
  $op = $1;
}
else
{
  $op = 'NotAllowed';
}

# convert $op into a modulename.
(my $modname = $op) =~ s.::./.g; # since you don't allow :'s this isn't needed, but it's useful in the general case.
$modname .= '.pm';
eval { require $modname };
die "Couldn't find class $op : $@\n" if $@;
$op->perform(...);