Access.md added.

Some thoughts around identity and access management.  
Ideas still rough, but trying to share early.  Comments welcomed.

Some of this maybe should go into docs/security.md
It is usually superior to offer lazy account creation to a plugin at the point in time that an identity accesses the system with no corresponding user - i.e. if `getUserByIdentity(source, uid_from_auth_plugin) == null { lazilyInstantiateUserWithIdentity(...) }`

Having to invoke api calls to create user accounts is rarely an operational advantage at any scale > 5-10 users, at small scales editing a file is just as sufficient (or changing a value in the datastore manually).  APIs aren't bad... just not usually critical path