You should document the default behavior (VerificaionLevel.COOKIE)