If you just want to know whether or not the form was posted (as opposed to knowing whether or not the user clicked the "login" button... which is what you are presently testing), then you can just replace:

my $doit = param('login');
[download]

with:

my $doit = $ENV{REQUEST_METHOD} eq 'POST';
[download]

edoc's answer above, though, is also perfectly correct... and possibly a better answer. Still, checking whether the request is a GET or a POST is popular idiom.