You can set a single cookie with the username and password, delimited somehow, and parse it yourself. Or use something like CGI::Cookie.
BUT
Just to drive it home:
Do all authentication on the SERVER side.
Don't SEND any content you don't want being seen.
Don't send the username, and especially not the password, back and forth in plain text for every transaction. Use a session ID to identify the user (like a temporary username, auto-gen one that's unlikely to be guessed) and a MAC as a temporary "password." Use a one-way encryption of the session ID (something like Digest::SHA) salted with a secret string.
Then just validate the MAC by comparing it to the re-encrypted session ID provided to decide if they've logged in.