if the $c's were strings, you would just need to swap these round:

print "Content-Type: text/html\n\n";
print "Set-Cookie: $c1,$c2,$c3\n";
[download]

And break the Set-Cookie into three separate lines of one cookie, with a single \n on the end of each one.

(The two \n's signify the end of the header, so the Set-Cookie isn't being obeyed. it's presumably appearing on the page.)

But your $c1, $c2 etc are objects and will just print memory-address gibberish in this form. You need to use CGI.pm's header method: it'll send them right, and take care of those minor formatting issues too.

update: OEMike is right and i am a fule. CGI::Cookies are string context overloaded (?terminology) and will print nicely the way he called them. and they can be concatenated after all, but with a semicolon, not a comma as he had it. sorry bout that. must.... read... docs...