Third question: I have read several times that taking the ref of an object to determine what it is can be a bad idea. Is it possible that the user could pass a valid CGI object that won't have a ref of 'CGI'?

Well, if someone has subclassed CGI then the ref will return the string of that class instead. Is there an isa() method in Perl? If not, there certain is a can() method and you could call some method of the ref that is 100% unique to CGI as a means of checking the inheritance tree.