You're confusing subroutine invocation with method invocation. When you do

if (!authenticate($session)) { ...
[download]

you're passing a single parameter.

sub authenticate {
    my ($self, $session) = @_;
    ...
[download]

then puts this this single parameter into $self, which isn't what you expect.

To invoke authenticate() as a method, you would need to write

if (! $self->authenticate($session)) { ...
[download]

But this wouldn't work, since start() doesn't set up $self.