Access.md added.

Some thoughts around identity and access management.  
Ideas still rough, but trying to share early.  Comments welcomed.

Some of this maybe should go into docs/security.md
I'm fine with you building something.  
I didn't understand what you meant when you said authz cold sit between storage and registry. 

I agree that authz could be full contained in the apiserver binary or it could call out to another service.

I envision APIserver calling an Authorize() function once for every API call, at a point early in the HTTP request handling.

Authorize() takes the username, an identifier for the API method called, the resource path, and, in the future, more contextual information.