++Chmrr! I haven't figured out yet where to look in the code for a \0 sneaking in, but I did this:

my $user = $session->param('user');
eval(Data::Dumper->Dump([$user], ['$user']));
[download]

and $user started working! So it looks like there's something irregular getting tagged onto the end of the blessing, but only when the code is retrieved from the session.

Well, I don't feel quite so bad that I couldn't track that one down!

Cheers,
D.