Try upgrading 4.0.0.4 and use the OCK.
Support for Client Roaming Based on Opportunistic Key Caching
Instant also supports opportunistic key caching (OKC) based roaming. In the OKC based roaming, the AP stores a
cached pairwise master key (PMK) for each client, which is derived from last 802.1X authentication completed by
the client in the network. By default, the 802.1X authentication profile enables a cached PMK, which is used when a
client roams to a new AP. The cached PMK is used when a client roams to a new AP. This allows faster roaming of
clients between the IAPs in a cluster, without requiring a complete 802.1X authentication.