pg_hba.conf

Ran into a mystery that I can't seem to figure out....


I want to authenticate using SSL for all external IP addresses that I have in my
subnet.  I also want to be able to authenticate via non-SSL for localhost (not
unix socket).

I thought something like this would work:

host       all    all    127.0.0.1/32     md5
hostssl    all    all    192.168.0.1/24   md5

But I have a localhost client that can't log in because it keeps trying to
authenticate via SSL.

What am I doing wrong?  It seems simple enough.