This is an update to my original post.  After upgrading the firmware of an EAP today, the release note mentions that the device is " Adapted to the deviceSecret mechanism" which is a new form of authentication between the controller and the device.  I am only guessing here, but the new switch running config entry is probably related to the new form of authentication that is being implemented but that has not yet been documented.  For those interested, there is some information available on the internet.  Just do a Google search for "deviceSecret mechanism".