Cisco Switching/Routing :: 891W ISR / Can't Get SSID To Broadcast

I'm working with some 891W's that have the internal 800-series AP. I have this router set up initially using Cisco Config Express, then, using Cisco Config Professional 2.5 I set up the firewall and other featuress that CCE doesn't do.  Overall this is a very simple router, meant to be a small business Internet gateway device but is currently in my lab. 
 
The intended WLAN setup is very simple.  One SSID, with broadcast enabled, using WPA2-Personal.  Auth: open  Encryption is both TKIP and AES-CCM. 
 
However no matter what I do I cannot get thhis thing to broadcast . In the past I had sometimes run into issues where if I had more than one AP running independently it would cause a channel conflict and one or both would cancel each other's radio, so I disabled all other AP's in my vicinity. 
 
Also I've had issues in the past where f I enabled both TKIP and AES, sometimes clients can't find the AP as a result.  My solution had been to disable one of them leaving just the other - no change here however. 
 
Via the IOS, ssid config shows mbssid guest-mode which I believce is default. 
 
Interestingly, if I do the following:
 
ap# Config t
ap(config)# dot11 ssid <myssid>
ap(config - ssid)#guest-mode
end
 
I end up with both "guest-mode" and "mbssid guest-mode" in the sh run for the AP, and voila, my AP broadcasts the SSID.  However clients end up joining without any security at all, no prompts for pre-shared key or anything.