Because the %ENV for the CGI doesn't have a variable named USER. You need to remember that when you use a CGI, it is a program being run on the web server in the environment of that web server. It could be in Karachi, and certainly has no idea who "Hoot" is.

A way to get closer to what you want would be to require the user to authenticate first, and then use $ENV{HTTP_USER}, which would be set to the login with which they validated.