The comments about using CGI.pm are certainly valid, and I'd certainly go along with them in the context of CGI scripts.

But just to answer the specific question, your problem is that you're printing the two newlines signifying the end of the HTTP headers, and then doing the Set-Cookie. Try this instead:

print "Set-Cookie: .$user.=.$pws.; expires=..; path=./.; domain=.local
+host.;";
print "Content-type: text/html\n\n";
[download]

Be Well.