I think the documentation is misleading here. Only elements of the path can be matched this way, with / as delimiter. So you will need:

get '/login/:username/:password' => sub { ...
[download]

But you should consider that such a GET request will need Javascript for logging in to the site, where a normal form submission will not need Javascript.