my $cookie = cookie(
   -NAME=> $cookie,
   -VALUE=> $pw,
   -EXPIRES => "+24h",
   );
[download]

The thing that strikes me as odd is -NAME=> $cookie. Is this the real code, or is it just a typo in this example? I think something like -NAME=>'pw' is going to work better.

For me, this is working rather well:

my $cookie = cookie(-name=>'username',
                     -value=>$username,
                     -expires=>'+5d',
                     -path=>'/',
                     -domain=>$domain,
                     );
[download]