I wouldn't worry about security with the PIX behind the 3660 I would jsut built a Access list to keep people out of the router block Telnet and maybe ICMP
You should not need a new activation key unless you want to use IPSec or other new features but if you do contact your VAR and they can help you for a Fee of course.