You need to send the HTTP header using the CGI::Session method 'header'. Note that the documentation may state incorrectly that

$session->header;
[download]

will output the header, complete with CGI::Session cookie information. That should actually be

print $session->header;
[download]

Yes, I wrote to the authour and he wrote back to confirm this mistake.

--t. alex
Life is short: get busy!