First, write the whole thing as a normal CGI+pure HTML page, and get the functionality working that way.

After you have the working application, it's easy to add a toolkit like jQuery to re-style the "You need to change your password" message.

Your application needs to work with Javascript disabled, otherwise users will circumvent the password change prompt by disabling Javascript.

Catalyst has drop in sessioning and such but you will have to set-up your DB/tables to match and while what you're doing is pretty common, it's not in any code samples or guides I know. This is not what I would call trivial. Any single piece of it is easy but it sounds like you're shooting for real security and that is not easy. Even experienced devs get it wrong quite often.

The main thing is what Corion said: forget about Ajax until you have working code with regular HTTP/CGI. At that point jQuery or a few other high level packages make it really quite simple. Again, it's straightforward once you know what you're doing. It's actually extremely difficult if you haven't done it before because there are many small pieces to understand. Not to dissuade, just to let you know that even with help and some prefab code this is not a small project if it's your first stab it.

When it comes time to add the AJAX piece, I've found that CGI::Ajax is, far and away, the easiest way to do AJAX with Perl. (I'm not going to claim it's the most efficient, but it is the easiest.)

I used CGI::Ajax when I was first starting out with Ajax & Perl, but it has several really problematic things that it does- especially with properly encoding the query strings.

These days I just use the Ajax functions in jQuery (they are more powerful anyway) and use JSON if I'm outputting data or sometimes just return HTML.

CGI::Ajax is fine for when you first start using AJAX but once you understand how it all works together, you really are better off doing it yourself.