You could use CGI::Session.
Here's a loose plan for doing it.

main.cgi would

• 1) make sure there's a session
• 2) gen or regen a password
• 3) save it to the session (maybe call flush(), is it?) parameter 'string_to_render' (?)
• 4) output html that has

  your pw: <img src="secimage.cgi">

secimage.cgi would

• 1) get remote user's session id
• 2) look inside the session for 'string_to_render'
• 3) output to screen.

The downfall here is that the sessions could be potentially read by third parties, etc. Of course, the sessions are not named after the usernames.