Make it:

  passwd   => substr($pass,0,8),
[download]

And it should work.

I d/l'd your script and ran into the same frustration ... Everything looked good compared to mech-dump 'http://www.perlmonks.org?node_id=109' and browser/ViewScource ... tried removing the cookie jar, changing the agent, etc.

Finally went to Live HTTP headers in firefox to take the POST'd data to manually create a POST w/LWP (instead of mech), and then noticed that my password was passed as 12345678 when it's really 123456789 ... Checked the html source again and there is a maxlength=8 for the password field ...

/me goes off to research now how to recognize that in WWW::Mechanize ...
Update: See RFC: Where to patch to enforce maxlength in Mech? for thoughts on possibly adding a feature/patch for it.