The problem lies in the wlconf tool. wlconf can not set the psk to the driver successfully. This ioctl returns -1. The wlconf source is located in the 'src/router/wlconf' directory. check the wlconf routine in wlconf.c.

when you save any configuration from UI, cgi sets different nvram attributes according to the value you changed and starts the wlconf tool. This tool reads the values from nvram and set those info to the wireless driver.
In our case nvram is getting updated properly but the wlconf fails to set the PSK value to the driver. That's why the AP is behaving as a non secured one.