May be it will be better to rewrite it with

struct GrantedAccess {   
        bool isAdmin;
        bool canRead;
    }
mapping(address => GrantedAccess)  accessRights;
mapping(address => GrantedAccess)  accessRightsHistory;

it helps:
1)reduce boilerplate code for "admin" and "reader" (now it's almost copy-pasted) roles and makes it more easily to add new roles
2)Remove iterating over history
3)operations over mapping instead of array in this case lreduce gas consumption

I dont' clearly see how it must work but it looks like better can place the bet and then say "I'am a winner! Give me TheMoney!"

See pull request #2

there is information that sometimes legal call of method can have data.length > sum of args lengths due to padding (transactions from parity multisig wallet for example)
So correct code for onlyPayloadSize should be
modifier onlyPayloadSize(uint size) { assert(msg.data.length >= size + 4); _; }

Also brief look at code shows what you check invariants of all arguments so actually this modifier maybe useless

Consider not using allTokenHolders[] in XWinToken and you can remove all related boilerplate
I understand it all appears cause of DividendManager.() payable( See #7) but without all this it will be much better

DividendManager::function () payable
1)costs to much gas (gas limit for fallback function is 2300 )
2)Even without low gas limit it does't work as expected: if token becomes popular - you have to iterate over long array of owner addresses and do manipulation in storage. There is no gas-limit to complete this operation for sure. And this means that not all owners get their dividend record increase
3)Also - rewriting this code cause to remove all this allTokenHolders[] boilerplate code in XWinToken #8

I don't see why do you need all this whistles and blows with AuthenticationManager
In XWinToken You define accountReaderOnly function modifier but never use it.

I'am sure it will be better to completely remove it for now.
Also consider remove Reader access right from AuthenticationManager

From version 0.4.13 the throw keyword is deprecated and will be phased out in the future.