So far there is no evidence of a script called download.pl in your examples, just the URL. I am skeptical it exists because it would mean you are mixing CGI with Catalyst and using nearly the same names. In your Catalyst application, instead of download.pl there will be a URL path like /app_name/controller_name/download or host:port/controller_name/download if you are running on a high port or using the development server. In those cases, my answer is the right one.

Catalyst has many parts, including simple deployment, that are extremely difficult for a beginner and it looks like maybe you are reading Catalyst documentation and CGI documentation (perhaps from a webhost?) and trying to mix them. It can be done, it works very badly but it's possible. Your code is wrong for that approach too and I highly discourage it. :( Better to go with vanilla CGI if on a budget host where CGI is the only deployment option.