You noted that you're not using CGI, but does that mean you can't use CGI and friends? Or you just aren't, for the current code? I've used CGI::Cookie successfully for quite some time, and it works well. Obviously for your design, you'll need to encode the password to obfuscate it, if you're passing that back as a token to the server; Digest::MD5 will help there, or one of the other more secure methods.

if ($ENV{'HTTP_COOKIE'} && $ENV{'HTTP_COOKIE'} =~ /vote/) {
   $cookie_state = 1;

      my (@rawCookies) = split (/; /,$ENV{'HTTP_COOKIE'});
      my (%cookies);

      foreach(@rawCookies){
         ($key, $val) = split (/=/,$_);
         $cookies{$key} = $val;
      }

      foreach $name (keys %cookies) {
         $cookie_value = $cookies{$name};
      }
} else {
   if ($action =~ /results/ && $poll) {
      $c1 = new CGI::Cookie(-name    =>  'vote',
                            -value   =>  [$poll],
                            -expires =>  '+1M'
                           );
      print "Set-Cookie:", $c1, "\n";
   }
}

$c2 = new CGI::Cookie(-name    =>  'plucker',
                      -value   =>  'true',
                      -expires =>  '+1h',
                      -path    =>  '/',
                      -secure  =>  '0',
                     );

$plucker = cookie('plucker');

if (!$plucker) {
   print header(-cookie=>[$c2]);
} else {
   print header() if ($type ne "Plucker");
}
[download]

Also, noticed you mention that you can't 'unset' headers. You certainly can, if you put those headers in a scalar, and undef() them later on, as required. Without code and not knowing your design, I can't say whether this is the right longer-term approach, but it will allow you to 'unset' them at will.