Correct...your other option is to enable CPSec, bring up the Aps for the initial provisioning on-site or in the same VLAN as the controller to allow the AP to pull the AP image locally, and come up with a CPSec (IPSec) tunnel. Once done, you can take the AP to the installation site and when the AP discovers the controller, will use IPsec to bring up the tunnel and will not require FTP. All future AP upgrades will be within the CPSec tunnel as well.