Your example is wrong: if you are going to use remote_user information from CGI.pm, then you will never reach that prerun mode without a valid user and the code unless ($user) ... is useless.