Access.md added.

Some thoughts around identity and access management.  
Ideas still rough, but trying to share early.  Comments welcomed.

Some of this maybe should go into docs/security.md
Admins will build all sorts of solutions in proxy layers (auth, rate limiting, security auditing, logging, proxy hack resources, etc) if you let them.