I'd add something like ``isHttpHeaderBased`` and ``isCookieBased`` methods to ``VerificationLevel`` so you can check this without relying on current implementation of verification levels. This way you're leaking internal API information to http-client's code.