I had overlooked the "via browser only". Is that an admnistrative policy, or just a fuzzy translation for "via proxy only"? In the latter case, it might be possible to copy the proxy settings into the cpan config.