See also CGI::Application redirect loses cookie and my reply, Re: CGI::Application redirect loses cookie.

Update: the CGI::Session docs encourage doing a flush() on the session whenever you've finished doing anything with it.