this (form tag) causes login.cgi to run, where login.cgi is depends on the way your server is setup.

td( input( { -maxlength => "30",
                   -name      => "password",
                   -size      => "30",
                   -type      => "password"} )
[download]

this (input tag) sends a string 30 char or less in length to login.cgi called password (-name)...-type "password" just means it will show *** when trying to type it in not that it will be encrypted. Same thing with username.

Ovid covers how to get and deal with these parameters pretty well in his course, as for authenticating them: look at security faq and question 13 for more links