Using selectors to set ensure

This refactors it a lot more nicely than I'd done previously. However,
checking against undef I've found can be a little surprising (for one,
you have to use the default, you can't pass 'undef' as a value, at least
not from Hiera), so instead of undef, I'm using the boolean false, which
can be passed around safely.
Merge pull request #8 from andschwa/ssl-refactor

Using selectors to set ensure