I guess it is not a question of reference counts then. I have tried the following

$ssh->login($username, "$password");
[download]

and

my $newpass = $password;
$ssh->login($username, $newpass);
[download]

and

$ssh->login($username, scalar($password));
[download]

All to no avail. The only thing that has worked is either me hardcoding the password into my script or me using the Data::Dumper technique.