You can convert the RAP-3 to an Instant AP (IAP) and then IPSec is optional. It won't be managed by a controller, though. If you have Airwave in your environment, you can use it to monitor/manage the IAP(s). An additional benefit of an IAP vs RAP is that you can add IAPs to the site and not have roaming issues!! :)