Don't force a specific AP;
match wpa2 as well as wpa for encryption.