I spent hours trying to solve this bug and the solution was so simple. 
My rpcpassword in my bitcoin.conf file contained a '#' character.

Prevent this from happening, by outputting this an error or warning when users run bitcoind.

Right now, you can have a # character as a password and it will work on the command line but will fail when you JSON-RPC.
{
    wchar_t** wargv = CommandLineToArgvW(GetCommandLineW(), &argc);
    std::wstring_convert<std::codecvt_utf8_utf16<wchar_t>, wchar_t> utf8_cvt;
    argv = new char*[argc];
    args.resize(argc);
    for (int i = 0; i < argc; i++) {
        args[i] = utf8_cvt.to_bytes(wargv[i]);
        argv[i] = &*args[i].begin();
    }
    LocalFree(wargv);
}
WinCmdLineArgs::~WinCmdLineArgs()
{
    delete[] argv;
}
std::pair<int, char**> WinCmdLineArgs::get()
{
    return std::make_pair(argc, argv);
}
#endif
}