In general, you'll find that you will save yourself a lot of grief if you print your header as early as possible in your script. That way if something goes wrong and you print an error message, it won't confuse the browser (which expects a particular Content-Type message as the first output of your script.

I use the fatalsToBrowser and warningsToBrowser in CGI::Carp recommended by Joost and ikegami extensively.

Remember, the user under which a CGI script is executed through the webserver is generally different from the command-line environment user, and will often lack file permissions and environment variables that you expect it to have.

Update: I notice that you do not specify any path for the password.txt file -- that seems to be one very good reason why it may fail to open the file, and (as pointed out by Joost, it will then print an error message which precedes the header (which is bad).