There exist probably some black hat hacking tricks to steal away one user's authenticated session and pass it on to someone else, but I would not know them.

I see only one other solution but it depend on the type of authentication used. If it is basic authentication then you might use a specially crafted URL to log-in:

http://username:password@host.domain
[download]

and you could email that url to the user.

A standard Apache server using basic authentication will accept this to authenticate a user rather than having the browser pop-up the "Username / login" dialog box. If it is a more sophisticated scheme that will not work.

If that doesn't work you can still PAR-package your WWW::Mechanize script (or slim it down as much as possible to have fewer dependencies) and give that to the user and let him run it to log in.