I'd suggest (if you can) using Apache's UNIQUE_ID environment variable:

my $unique_filename="/home/web/user-".$ENV{UNIQUE_ID};
[download]

This variable will remain the same throughout an entire session and unique for each user.