Is there any reason you aren't using cookies?

If not, then just send them a cookie with each page:

# major "snip", but you get the idea...

my $q = new CGI;

my $cookie = $q->cookie(-name=>'timeout',
                        -value=>'session id',
                        -expires=>'+15m');

print $q->header(-cookie=>$cookie);
[download]

then just check that cookie exists.

.02

cLive ;-)