Aaah - now I realize. You said "all other users get $session->{counter} incremented by 2". So, is it that the first user sees:

1
<reload>
2
<reload>
3
[download]

... and the other users see

1
<reload>
3
<reload>
5
[download]

?

Then I would look at what requests the browsers send to your server and print out each request, and the session value before and after. Maybe the session value is also incremented for static stuff like CSS or image files? Or for the 404 page that a missing favicon.ico creates?