Your first version is different from the others because you give the hash itself as parameter instead of a reference to the hash. The parameter list of a subroutine invocation is an array context. But a hash in array context is simply an array with key value pairs. So with your first version

XMLout(%$self , XMLDecl => 1 ...

# is nearly* equivalent to

XMLout(_username, Polo, _user_tags, [],_user_pass, undef , XMLDecl => 
+1 ...

#  * not exactly equivalent because the order of the hash 
#    contents is random
[download]

Your second version seems to be identical to your third version (at least I couldn't spot a difference at first glance, but I didn't test it), could it be that you made some typing or copying error somewhere?