You're probably running under Apache::Registry. From the CAVEATS section of Apache::Registry:

Apache::Registry makes things look just the CGI environment, however, you must understand that this *is not CGI*. Each httpd child will compile your script into memory and keep it there, whereas CGI will run it once, cleaning out the entire process space.

I wouldn't be surprised if my $Report is a package lexical, which only gets initialized once. And from then on keeps its value between requests.

I haven't used Apache::Registry myself ever, but I think you can solve this by putting your code in a block, like this:

{
my $Report = "";
... yada yada yada
print STDERR....;
}
[download]

This will ensure that $Report will get initialized properly each request.

This is untested, so YMMV.

Liz