Rather than using a global session variable, I recommend using CGI::Application::Plugin::Session. That will ensure that your session object plays nicely with CGI::Application, and allows you to call a ->session method on your application object, rather than relying on package globals. (This is very convenient for subclassing your app, too.)

Update: See also Foo->new() vs. new Foo() for reasons why you should avoid indirect method syntax.