Maybe it's just me, but a helpful reply on how to debug these sorts of things is worth more in the long run than an immediate solution to a specific problem. As for your attack, I can't be bothered to install a module, learn its workings, and learn how to run a CGI program just to see the output for that code. Does that make me unqualified to even try to help out?

Yes, its is likely you are not qualified

You could have started your post with: I can't examine or run your program ...

Look at moritz's response, he took the generic approach, but missed $session->header in the code

Its easy to offer generic advice and talk in conditions, but when the OP went through the trouble of posting his code, its just noise

But its very likely the OP hasn't even seen our replies