Yeah, I'm sorry. I didn't read the original flow right. AM is right and I alluded to it above. You can't print headers twice or you'll get wonky behavior. Give something like this a spin.

my $current_page = shift || die "Need a current page";

my $session = CGI::Session->new
    or die CGI::Session->errstr;

my @pages = $session->param('authorized_pages');

push @pages, $current_page
    unless $pages[-1] eq $current_page; # Just a guess.

$session->param( authorized_pages => \@pages );
$session->flush();

my $uri = URI->new( CGI::url() );
$uri->query("page=1");
$uri->fragment("");

print $session->header(-location => $uri,
                       -status => 302 );
[download]

URI is in there to get the absolute URI and mess with the query string and fragment. Munging URI as strings is like parsing HTML with regexes. It can be done but it's error prone and why shoot yourself in the foot when there are great tools that are just as easy, if not easier.