Access.md added.

Some thoughts around identity and access management.  
Ideas still rough, but trying to share early.  Comments welcomed.

Some of this maybe should go into docs/security.md
@brendanburns I've come around to the idea that we should use the OAuth protocol for passing a bearer token to an API server to as part of authentication (RFC 6750).  I'm reserving judgement on whether we would need to support scoped access tokens as mean of authorization.