The best I can figure is that it doesn NOT sent the hidden field along with the rest of the stuff.

Why do you have to guess? Can't you view the page source? My quick run of your code shows that hidden field is there:

<form method="post" action="secalert_display.cgi"
  enctype="multipart/form-data" target="_top" name="new">
<input type="submit" name=".submit" 
  value="Enter a new record for a Secalert" />
<input type="hidden" name="MODE" value="new"  />
</form>
[download]