Access.md added.

Some thoughts around identity and access management.  
Ideas still rough, but trying to share early.  Comments welcomed.

Some of this maybe should go into docs/security.md
Other options:  offering a project API scope `/projects/<id>/<kubernetes api>`

For global access via id (where supported, which isn't very consistent today) `/pods/<uuid>`

Subdomains have potential scaling limits.  If using project names to identify the domain, you have to defend against profane or vanity names, and probably support blacklist limits on new project names.  In non-hosted environments is less of an issue.  Requires that the apiservers be tied into DNS, which is onerous to configure in some environments.  Nice in some contexts.

Defaulting to project makes a lot of sense.  Query parameter or header can also work.