I agree it is kind of unsafe to do this kind of comparisons - I was lazy :)
But I would not add isHeaderBased/CookieBased to the VerificationLevel directly, since other levels may also be cookie/header based (in the future) but use a different header/cookie. So it is probably best to check for particular values. I'll add these utility methods to the client class instead.