I have configured my 851 router as follows:
dot11 ssid Your-SSID
authentication key-management wpa (needs to be taken out)
wpa-psk ascii 0 Your-WPA2-Pre-shared-key
encryption mode ciphers aes-ccm
Now I am using the latest IOS which is "c850-advsecurityk9-mz.124-15.T10.bin" and in order for you to add "encryption mode ciphers aes-ccm" you have to take out key management under the dot11 ssid interface which i have also done. Now on my wireless device I can set it for WPA2-PSK or WPA2-aes and I have used both and neither one is working my wireless device is not associating with the cisco. does anyone have any ideas why its not associating with my router.