I happen to have just started doing something similar for my application (although I do other webapps in java, which has more standard answers):

1 & 2. I'm directly using CGI::Session inside CGI::Application, of course then I can use any name I want, but that's not my motivation: it was just the first thing I did:-)

3. I would store that in the session, but if you are using the MySql for storing sessions in CGI::Session, it amounts to the same thing: it's safely inside the database, but you don't have to explictily do it.

4. Get a digital certificate, from places like verisign. Unfortunately you do have to pay for them (and year after year, just like passports, only shorter and more expensive, but it does work worldwide.)

5. Not understanding your question, we all use DBI to access Mysql

6. I use Template Toolkit with CGI::Application, I'm pretty happy with it, but again it's the first perl template I learnt after reading people's post here.

Hope that helps.