I have 2 servers:

1. Content Delivery - the live site pointing to the web database.
2. Content Management - the internal only site pointing to the master database.

I want to prevent access to /sitecore on the live site, and require content editors to access this from the Content Management server.  How can I lock this down to prevent access from the Content Delivery server?