What does $res->content look like for the PDF. my gut feeling is that your cgi is running on a https server doing reqests in the background to a http server to get content and the content returned for a pdf form is a mix of html and linked content that points back to the http server hence the secure/non-secure error..