Access.md added.

Some thoughts around identity and access management.  
Ideas still rough, but trying to share early.  Comments welcomed.

Some of this maybe should go into docs/security.md
Potential options: exchange long lived tokens for short tokens (sucks for clients).

Allow consumers to set custom token expiration, allow administrators to define maximum token expiration based on scopes.

Support scopes for tokens - including deep scope values like "project/foo/read".  Scopes are unioned together, intersected with current user's abilities.