If I understand you correctly, you're storing sensitive data in cookies. That is fundamentally insecure.

I suggest you use CGI::Session instead (and either use a cookie or a query parameter to pass the session ID).