Access.md added.

Some thoughts around identity and access management.  
Ideas still rough, but trying to share early.  Comments welcomed.

Some of this maybe should go into docs/security.md
If you ever want to expose global resources, it's probably better not to use query param or header.  I.e. if you try to overlay `GET /pods/<uuid>` with `GET /pods/<name>?project=<projectid>` then you can't use a default project, and clients and authz checks need to be aware of that distinction.  If you want to reserve the ability to fetch pods by global uuid at some point in the future across projects, forcing a different URL path or introducing a complex attribute.  If a project represents a namespace, and the resource path includes a name in that namespace, there are advantages to making it explicit in the access pattern `/projects/<id>/<resource>/<name_in_project_namespace>`