I got the same response from a few people in comp.lang.perl.misc, and putting print $co->header(); before the real header enables you to see what's actually being sent to the client.

I was using IE, and for some reason it chooses not to have anything to do with any cookies with an expiration of shorter than 2 hours. Go figure. So anyway, my code above works fine if you set -expires=>'+2h'... under IE, and apparently it all works fine under NS anyway. Damn microsoft, causing me another days hassle.

Anyway, a big blessing to all you monks who tried to help out, but at least we can say it's not our fault, it was Bill.