Note that the httponly option only works on the more recent browsers such as IE6, Firefox3, and Opera9.5. Also, I believe that you are missing your domain and cgi-bin path.

#!/usr/bin/perl

use strict;
use warnings;
use CGI qw/:standard/;
use CGI::Cookie;
use CGI::Carp qw/fatalsToBrowser/;

my $c = CGI::Cookie->new(
    -name     =>  'mycookie',
    -value    =>  ['foo','bar'],
    -secure   => 1,
    -expires  => '+3M',
    -domain   => 'your domain',
    -path     => '/path/to/cgi-bin
    -httponly => 1,
);
print "Set-Cookie: $c\n";
print "Content-Type: text/html\n\n";
[download]