pg_hba now templated/generated, with ssl (defaulting to off) settings added to postgresql.conf -- both should allow for site-specific opt-in to SSL configuration.
added postgres ssl documentation to buildout