Access.md added.

Some thoughts around identity and access management.  
Ideas still rough, but trying to share early.  Comments welcomed.

Some of this maybe should go into docs/security.md
@smarterclayton PTAL. I've modified the userAccount section in the latest commit.  I've added a UID to track users over account changes, and I've left room for a layer of indirection between the userAccount object and the one or more sources of authorization that might be used for that userAccount.