What am I missing?

The short answer is headers. Usually people use CGI to handle details like that. It can also make the generation of html less painful.

If you don't want to use that module, you must print a header. Add this before the print in your sample above:

print "Content-type: text/html\n\n";
[download]

Phil