Access.md added.

Some thoughts around identity and access management.  
Ideas still rough, but trying to share early.  Comments welcomed.

Some of this maybe should go into docs/security.md
Prefer straight up OAuth2 server with necessary plug points for intercepting auth.  Auth flows with kerberos / can get tricky, generally those integrations are done in front of the client-credentials flow.  JWT is just one solution.  One problem with auth tokens is that refresh token -> access token flow can get irritating - in many environments folks prefer to simply use an access token with sufficient time to correspond to a reasonable session for human interactions, and longer tokens for machine interactions.