Use a valid SSLMODE value.

Valid values are one of:

disable
allow
prefer
require
verify-ca
verify-full

I think 'require' makes the most sense for the default installations of postgres that I've seen in the wild, but for now it's enough to just not use an invalid default.