The Location header in HTTP must be an absolute URL, you are providing a relative URL.

In most CGI implemenations (or at least, Apache), a "root-relative" url in a location header is interpreted by the webserver as an "internal redirect" - i.e. the server will return the content at that url, without informing the client.

What I think is wrong is that in most server configurations it's not allowed to have anything but executables in the /cgi-bin/ location - that means the images should be put somewhere else.