A ha! It looks like CGI::Session is calling ->param in list context with arguments:
https://metacpan.org/source/MARKSTOS/CGI-Session-4.48/lib/CGI/Session.pm#L364
The temp solution to this is to set the following in your code:
$CGI::LIST_CONTEXT_WARN = 0
An issue needs to be raised against CGI::Session to change it to use multi_param or switch off the warning. The slight irony is that i took over maintenance of CGI from Mark, the current author of CGI::Session...