$password_hash was not being encrypted which caused an ALTER ROLE to be run every time the puppet agent runs. This should fix that. Fixes puppetlabs/puppet-postgresql#216