Access.md added.

Some thoughts around identity and access management.  
Ideas still rough, but trying to share early.  Comments welcomed.

Some of this maybe should go into docs/security.md
On the other hand, a hosting provider might already have auth, rate limiting, auditing, logging, and resource management systems that cut across many types of web services.  So, (not sure if this is where you are going) I would hesitate to build in impediments to building proxy layers.