Access.md added.

Some thoughts around identity and access management.  
Ideas still rough, but trying to share early.  Comments welcomed.

Some of this maybe should go into docs/security.md
Both are going to be required - some environments will require auth solutions that integrate with Apache (mod_auth is by far the dominant auth solution integration in enterprise environments) or Nginx.  We would prefer to limit that integration though to the client-credentials flow of an oauth exchange though - and let tokens pass through.  

SSL client certs, when used, are generally acceptable in layering (cert is used to get token, and audit traces both cert and token use).  Some have asked, but not implemented, the ability to tie tokens to cert attributes.