Hi Dan,
WPA is added to the new IOS version but the latest VxWorks based versions do not have it yet. This means you can not run WPA on a BR350 yet.
If the radio link fails then the non root bridge will try to associate to the root when the link is fixed, you should no have to reload the root for this.
What firmware version you using on both ends ??
try the EAP debugs and see why it is failing before you reload the root, it sounds like you have another problem there also.
David