This:

COOKIE_PARAMS            => {
                                        -expires => '+1h',
                                        -path    => '../tmp',
                                        },
[download]

messes it up for you. The cookie path param pertains to the URL of the request, and so it's not sent back to your app (since /cgi-bin doesn't fall under ../tmp).

Try leaving it out until you need it:

COOKIE_PARAMS            => {
                                        -expires => '+1h',
                                        },
[download]