diff --git c/core/modules/system/lib/Drupal/system/Controller/ThemeController.php w/core/modules/system/lib/Drupal/system/Controller/ThemeController.php
index d46e4cf..b498713 100644
--- c/core/modules/system/lib/Drupal/system/Controller/ThemeController.php
+++ w/core/modules/system/lib/Drupal/system/Controller/ThemeController.php
@@ -7,45 +7,45 @@
 
 namespace Drupal\system\Controller;
 
-use Drupal\Core\Config\Config;
+use Drupal\Core\Controller\ControllerBase;
 use Drupal\Core\DependencyInjection\ContainerInjectionInterface;
 use Symfony\Component\DependencyInjection\ContainerInterface;
-use Symfony\Component\HttpFoundation\RedirectResponse;
+use Drupal\Core\Access\CsrfTokenGenerator;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
+use Symfony\Component\HttpFoundation\RedirectResponse;
 
 /**
  * Controller for theme handling.
  */
-class ThemeController implements ContainerInjectionInterface {
+class ThemeController extends ControllerBase implements ContainerInjectionInterface {
 
   /**
-   * The system.theme config object.
+   * Token generator service.
    *
-   * @var \Drupal\Core\Config\Config
+   * @var \Drupal\Core\Access\CsrfTokenGenerator
    */
-  protected $config;
-
-  /**
-   * Constructs a ThemeController object.
-   *
-   * @param \Drupal\Core\Config\Config $config
-   *   The config.
-   */
-  public function __construct(Config $config) {
-    $this->config = $config;
-  }
+  protected $tokenGenerator;
 
   /**
    * {@inheritdoc}
    */
   public static function create(ContainerInterface $container) {
     return new static(
-      $container->get('config.factory')->get('system.theme')
+      $container->get('csrf_token')
     );
   }
 
   /**
+   * Constructs a Theme Controller Object.
+   *
+   * @param \Drupal\Core\Access\CsrfTokenGenerator $token_generator
+   *   Token Generator Service.
+   */
+  public function __construct(CsrfTokenGenerator $token_generator) {
+    $this->tokenGenerator = $token_generator;
+  }
+  /**
    * Disables a theme.
    *
    * @param \Symfony\Component\HttpFoundation\Request $request
@@ -61,27 +61,29 @@ public static function create(ContainerInterface $container) {
   public function disable(Request $request) {
     $theme = $request->get('theme');
     $token = $request->get('token');
+    $config = $this->config('system.theme');
 
-    if (isset($theme) && isset($token) && drupal_valid_token($token, 'system-theme-operation-link')) {
+    if (isset($theme) && isset($token) && $this->tokenGenerator->validate($token, 'system-theme-operation-link')) {
       // Get current list of themes.
       $themes = list_themes();
 
       // Check if the specified theme is one recognized by the system.
       if (!empty($themes[$theme])) {
         // Do not disable the default or admin theme.
-        if ($theme === $this->config->get('default') || $theme === $this->config->get('admin')) {
-          drupal_set_message(t('%theme is the default theme and cannot be disabled.', array('%theme' => $themes[$theme]->info['name'])), 'error');
+        if ($theme === $config->get('default') || $theme === $config->get('admin')) {
+          drupal_set_message($this->t('%theme is the default theme and cannot be disabled.', array('%theme' => $themes[$theme]->info['name'])), 'error');
         }
         else {
           theme_disable(array($theme));
-          drupal_set_message(t('The %theme theme has been disabled.', array('%theme' => $themes[$theme]->info['name'])));
+          drupal_set_message($this->t('The %theme theme has been disabled.', array('%theme' => $themes[$theme]->info['name'])));
         }
       }
       else {
-        drupal_set_message(t('The %theme theme was not found.', array('%theme' => $theme)), 'error');
+        drupal_set_message($this->t('The %theme theme was not found.', array('%theme' => $theme)), 'error');
       }
 
-      return new RedirectResponse(url('admin/appearance', array('absolute' => TRUE)));
+      // @todo switch to $this->redirect when admin/appearance converted.
+      return new RedirectResponse($this->urlGenerator()->generateFromPath('admin/appearance', array('absolute' => TRUE)));
     }
 
     throw new AccessDeniedHttpException();
@@ -104,23 +106,86 @@ public function enable(Request $request) {
     $theme = $request->get('theme');
     $token = $request->get('token');
 
-    if (isset($theme) && isset($token) && drupal_valid_token($token, 'system-theme-operation-link')) {
+    if (isset($theme) && isset($token) && $this->tokenGenerator->validate($token, 'system-theme-operation-link')) {
       // Get current list of themes.
       $themes = list_themes(TRUE);
 
       // Check if the specified theme is one recognized by the system.
       if (!empty($themes[$theme])) {
         theme_enable(array($theme));
-        drupal_set_message(t('The %theme theme has been enabled.', array('%theme' => $themes[$theme]->info['name'])));
+        drupal_set_message($this->t('The %theme theme has been enabled.', array('%theme' => $themes[$theme]->info['name'])));
       }
       else {
-        drupal_set_message(t('The %theme theme was not found.', array('%theme' => $theme)), 'error');
+        drupal_set_message($this->t('The %theme theme was not found.', array('%theme' => $theme)), 'error');
       }
 
-      return new RedirectResponse(url('admin/appearance', array('absolute' => TRUE)));
+      // @todo switch to $this->redirect when admin/appearance converted.
+      return new RedirectResponse($this->urlGenerator()->generateFromPath('admin/appearance', array('absolute' => TRUE)));
     }
 
     throw new AccessDeniedHttpException();
   }
 
+  /**
+   * Set the default theme.
+   *
+   * @param \Symfony\Component\HttpFoundation\Request $request
+   *   A request object containing a theme name and a valid token.
+   *
+   * @return \Symfony\Component\HttpFoundation\RedirectResponse
+   *   Redirects back to the appearance admin page.
+   *
+   * @throws \Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException
+   *   Throws access denied when no theme or token is set in the request or when
+   *   the token is invalid.
+   */
+  public function defaultTheme(Request $request) {
+    $config = $this->config('system.theme');
+
+    $theme = $request->query->get('theme');
+    $token = $request->query->get('token');
+    if (isset($theme) && isset($token) && $this->tokenGenerator->validate($token, 'system-theme-operation-link')) {
+      // Get current list of themes.
+      $themes = list_themes();
+
+      // Check if the specified theme is one recognized by the system.
+      if (!empty($themes[$theme])) {
+        // Enable the theme if it is currently disabled.
+        if (empty($themes[$theme]->status)) {
+          theme_enable(array($theme));
+        }
+
+        // Set the default theme.
+        $config->set('default', $theme)->save();
+
+        // Rebuild the menu. This duplicates the menu_router_rebuild() in
+        // theme_enable(). However, modules must know the current default theme in
+        // order to use this information in hook_menu() or hook_menu_alter()
+        // implementations, and doing the variable_set() before the theme_enable()
+        // could result in a race condition where the theme is default but not
+        // enabled.
+        menu_router_rebuild();
+
+        // The status message depends on whether an admin theme is currently in use:
+        // a value of 0 means the admin theme is set to be the default theme.
+        $admin_theme = $config->get('admin');
+        if ($admin_theme != 0 && $admin_theme != $theme) {
+          drupal_set_message($this->t('Please note that the administration theme is still set to the %admin_theme theme; consequently, the theme on this page remains unchanged. All non-administrative sections of the site, however, will show the selected %selected_theme theme by default.', array(
+            '%admin_theme' => $themes[$admin_theme]->info['name'],
+            '%selected_theme' => $themes[$theme]->info['name'],
+          )));
+        }
+        else {
+          drupal_set_message($this->t('%theme is now the default theme.', array('%theme' => $themes[$theme]->info['name'])));
+        }
+      }
+      else {
+        drupal_set_message($this->t('The %theme theme was not found.', array('%theme' => $theme)), 'error');
+      }
+      // @todo switch to $this->redirect when admin/appearance converted.
+      return new RedirectResponse($this->urlGenerator()->generateFromPath('admin/appearance', array('absolute' => TRUE)));
+    }
+    throw new AccessDeniedHttpException();
+  }
+
 }
diff --git c/core/modules/system/system.admin.inc w/core/modules/system/system.admin.inc
index 9db20be..8245cb5 100644
--- c/core/modules/system/system.admin.inc
+++ w/core/modules/system/system.admin.inc
@@ -176,57 +176,6 @@ function system_themes_admin_form_submit($form, &$form_state) {
 }
 
 /**
- * Menu callback; Set the default theme.
- */
-function system_theme_default() {
-  $request = Drupal::request();
-  $theme = $request->get('theme');
-  $token = $request->get('token');
-  if (!empty($theme) && !empty($token) && drupal_valid_token($token, 'system-theme-operation-link')) {
-    // Get current list of themes.
-    $themes = list_themes();
-
-    // Check if the specified theme is one recognized by the system.
-    if (!empty($themes[$theme])) {
-      // Enable the theme if it is currently disabled.
-      if (empty($themes[$theme]->status)) {
-       theme_enable(array($theme));
-      }
-      // Set the default theme.
-      Drupal::config('system.theme')
-        ->set('default', $theme)
-        ->save();
-
-      // Rebuild the menu. This duplicates the menu_router_rebuild() in
-      // theme_enable(). However, modules must know the current default theme in
-      // order to use this information in hook_menu() or hook_menu_alter()
-      // implementations, and doing the variable_set() before the theme_enable()
-      // could result in a race condition where the theme is default but not
-      // enabled.
-      menu_router_rebuild();
-
-      // The status message depends on whether an admin theme is currently in use:
-      // a value of 0 means the admin theme is set to be the default theme.
-      $admin_theme = Drupal::config('system.theme')->get('admin');
-      if ($admin_theme != 0 && $admin_theme != $theme) {
-        drupal_set_message(t('Please note that the administration theme is still set to the %admin_theme theme; consequently, the theme on this page remains unchanged. All non-administrative sections of the site, however, will show the selected %selected_theme theme by default.', array(
-          '%admin_theme' => $themes[$admin_theme]->info['name'],
-          '%selected_theme' => $themes[$theme]->info['name'],
-        )));
-      }
-      else {
-        drupal_set_message(t('%theme is now the default theme.', array('%theme' => $themes[$theme]->info['name'])));
-      }
-    }
-    else {
-      drupal_set_message(t('The %theme theme was not found.', array('%theme' => $theme)), 'error');
-    }
-    return new RedirectResponse(url('admin/appearance', array('absolute' => TRUE)));
-  }
-  throw new AccessDeniedHttpException();
-}
-
-/**
  * Recursively check compatibility.
  *
  * @param $incompatible
diff --git c/core/modules/system/system.module w/core/modules/system/system.module
index 10bc48d..0a56c0c 100644
--- c/core/modules/system/system.module
+++ w/core/modules/system/system.module
@@ -660,13 +660,6 @@ function system_menu() {
     'type' => MENU_DEFAULT_LOCAL_TASK,
     'file' => 'system.admin.inc',
   );
-  $items['admin/appearance/default'] = array(
-    'title' => 'Set default theme',
-    'page callback' => 'system_theme_default',
-    'access arguments' => array('administer themes'),
-    'type' => MENU_CALLBACK,
-    'file' => 'system.admin.inc',
-  );
   $items['admin/appearance/settings'] = array(
     'title' => 'Settings',
     'description' => 'Configure default and theme specific settings.',
diff --git c/core/modules/system/system.routing.yml w/core/modules/system/system.routing.yml
index a3bf62b..cd6c2d6 100644
--- c/core/modules/system/system.routing.yml
+++ w/core/modules/system/system.routing.yml
@@ -313,6 +313,14 @@ system_modules_uninstall_confirm:
   requirements:
     _permission: 'administer modules'
 
+system_theme_default:
+  pattern: '/admin/appearance/default'
+  defaults:
+    _controller: 'Drupal\system\Controller\ThemeController::defaultTheme'
+    _title: 'Set default theme'
+  requirements:
+    _permission: 'administer themes'
+
 system_timezone:
   pattern: '/system/timezone'
   defaults: