Gah
"Remote users cannot authenticate by using an account that has a blank password."
http://support.microsoft.com/kb/304040
I didn't know this because every where in the "real world" blank passwords are forbidden via group policy. I thought I was going to go crazy.