I am still investigating this issue, but here is something discovered using the WCS templates to push out a wlan config to WLC 4402 controllers.
I created a new wlan template with wpa security, etc and broadcast ssid turned off (unchecked), saved it and then applied it to my controllers.
I then opened up the web interface of one of the controllers to verify and saw the new wlan, but it had broadcast ssid enabled! I then went to each controller and discovered the same issue. I do not recall seeing any caveats for this but will check again.
Running WCS ver 184.108.40.206
wlc ver 220.127.116.11