I've figured it out!
It wasn't creating the session files.
My CGI::Session data directory needed permissions 777 rather than 766.
My new construct works because I'm passing my CGI object as the 2nd argument, so CGI::Session can find the session id from the cookie itself. Also, my cookie name should have been 'CGISESSID' so that CGI::Session could find the value.