I think you have a silent typo. Try changing
-expire => '',
to
-expires => '',
and double-check what '' means as an expire time. My quick read of the CGI pod doesn't say anything about this being legal, and a glance through the code suggests that you're not going to be sending an Expires header. Are you sure this is what you want?
Comment on Re: Cookies on Apache vs cookies on IIS
That could be the problem, I'll have to wait till I'm back at work, seems odd though, as I'm *sure* that I didn't touch that code during the transition to the IIS server.
As far as expires being blank, when I first read about how to use cookies (not that long ago :)), I read that a blank expires is the same as a negative expires - ie: not written to disk, only accesible while the browser is open. But, I could be wrong :)