Why do you want to create a URL? it looks like you get JSON in from some ajax call, why not push JSON back? Otherwise you could just send the following:

print $url.'/'.$json->{'username'}.'/'.$json->{'password'}
[download]

Also why are you passing passwords in the open?