u need a password to access the file from the web
thats not the same as a php script on ur server accessing the file on ur server
the php script (in this case formmail) just needs the file and directories to have the right permission
u probably set $CSVDIR to a URL. thats wrong.
set it to a file system directory path.
ask ur hosting provider what that is or use the testalert test in formmail to find it