Restrict external access to groot prod mysql server

[bcongdon]

I think we should close port 3306 on the prod server to close off external mysql access.

Any work necessary on the production mysql server can be done over SSH.