If I see code I like, like at a big commercial site, I can view page source, see what the src attribute is for a <script> tag, and then copy and paste that to the address bar to make a url which will display it.

That won't work with the code the OP and I posted, although it's easily defeated by other means (turn off JS, reload the page, then follow the steps you listed).

Far better to write your application in Perl like ikegami says with CGI::Session and that way the serious code is hidden on the server.

While I agree with everything you say, I didn't suggest CGI::Session as an alternative to the OP's code, but as an equivalent to the OP's code.