A comment on style: if the URL's you are redirecting to are Mason components, you could streamline the code like this

<%args>
    $uname  => 'x'  
    $passwd => 'x'
    $component    
</%args>

<%perl>

use warnings;
use strict; 
use lib "/var/www/itiv/modules";
use Mapps::Session;
use Mapps::Auth;

##########################
# try to authenticate
##########################
my ($auth, $uid) = Mapps::Auth::auth($uname, $passwd);

if ($auth == 1){
    my $s = Mapps::Session->new();
    my $sid = $s->new_session($uid);
    #my $sid = $s->sid();

    # set cookie
    Apache::Cookie->new( $r,
        name => 'session',
        value => $sid,
        path => '/', 
        expires => '30m',
    )->bake;   

    # invoke the requested component
    $m->comp($component);

}else{
    # no auth 
    $m->comp("login.html", msg => "Wrong username or password");
}
</%perl>
[download]

Mason components (unlike PHP / ASP / JSP pages) are callable (like subroutines) so you can just call the component instead of doing a redirect.