n.b. I finally got around to test this. Hence the belated reply.

Wow, hold it, you're doing this too low level. You're not supposed to be doing this the NPH way, there's still a webserver between the CGI scripts and the web browser, and that one is still postprocessing the headers that the CGI script sent to it — for example, adding a content-length header for plain pages. And there's a special pseudo-header for status codes: Status:.

When I did this on Apache 2 on my laptop:

print "Status: 307 Temporary redirect\n";
print "Location: " . URI->new_abs($files[int(rand @files)], "http://lo
+calhost/") . "\n\n";
[download]

then the headers that Live HTTP Headers displayed were:

HTTP/1.x 307 Temporary redirect
Date: Thu, 16 Nov 2006 19:55:06 GMT
Server: Apache/2.0.50 (Win32) mod_perl/1.99_16 Perl/v5.8.8 PHP/4.3.8
Location: http://localhost/images/060210-leaf.jpg
Content-Length: 0
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/plain; charset=ISO-8859-1
[download]

So the headers that got sent to the browser, are looking fine to me.