diff --git a/core/core.services.yml b/core/core.services.yml
index f00c450..1a3844f 100644
--- a/core/core.services.yml
+++ b/core/core.services.yml
@@ -100,7 +100,7 @@ services:
     arguments: ['@config.storage', '@config.storage.schema', '@cache.config']
   cron:
     class: Drupal\Core\Cron
-    arguments: ['@module_handler', '@lock', '@queue', '@state']
+    arguments: ['@module_handler', '@lock', '@queue', '@state', '@current_user']
   database:
     class: Drupal\Core\Database\Connection
     factory_class: Drupal\Core\Database\Database
@@ -441,9 +441,7 @@ services:
     arguments: ['@state']
   csrf_token:
     class: Drupal\Core\Access\CsrfTokenGenerator
-    arguments: ['@private_key']
-    calls:
-      - [setCurrentUser, ['@?current_user']]
+    arguments: ['@private_key', '@current_user']
   access_manager:
     class: Drupal\Core\Access\AccessManager
     arguments: ['@router.route_provider', '@url_generator', '@paramconverter_manager']
@@ -453,8 +451,6 @@ services:
   access_subscriber:
     class: Drupal\Core\EventSubscriber\AccessSubscriber
     arguments: ['@access_manager', '@current_user']
-    calls:
-      - [setCurrentUser, ['@?current_user']]
     tags:
       - { name: event_subscriber }
   access_route_subscriber:
@@ -684,10 +680,8 @@ services:
       - { name: event_subscriber }
     arguments: ['@authentication']
   current_user:
-    class: Drupal\Core\Session\AccountInterface
-    factory_method: authenticate
-    factory_service: authentication
-    arguments: ['@request']
+    class: Drupal\Core\Session\CurrentUserFactory
+    arguments: ['@authentication', '@?request']
     synchronized: true
   asset.css.collection_renderer:
     class: Drupal\Core\Asset\CssCollectionRenderer
diff --git a/core/lib/Drupal.php b/core/lib/Drupal.php
index 0ec88d7..18ad0ba 100644
--- a/core/lib/Drupal.php
+++ b/core/lib/Drupal.php
@@ -163,7 +163,7 @@ public static function request() {
    * @return \Drupal\Core\Session\AccountInterface
    */
   public static function currentUser() {
-    return static::$container->get('current_user');
+    return static::$container->get('current_user')->get();
   }
 
   /**
diff --git a/core/lib/Drupal/Core/Access/CsrfTokenGenerator.php b/core/lib/Drupal/Core/Access/CsrfTokenGenerator.php
index f2b015c..3ca2e3a 100644
--- a/core/lib/Drupal/Core/Access/CsrfTokenGenerator.php
+++ b/core/lib/Drupal/Core/Access/CsrfTokenGenerator.php
@@ -9,7 +9,7 @@
 
 use Drupal\Component\Utility\Crypt;
 use Drupal\Core\PrivateKey;
-use Drupal\Core\Session\AccountInterface;
+use Drupal\Core\Session\CurrentUserFactory;
 
 /**
  * Generates and validates CSRF tokens.
@@ -26,9 +26,9 @@ class CsrfTokenGenerator {
   protected $privateKey;
 
   /**
-   * The current user.
+   * The current user factory.
    *
-   * @var \Drupal\Core\Session\AccountInterface
+   * @var \Drupal\Core\Session\CurrentUserFactory
    */
   protected $currentUser;
 
@@ -37,18 +37,11 @@ class CsrfTokenGenerator {
    *
    * @param \Drupal\Core\PrivateKey $private_key
    *   The private key service.
+   * @param \Drupal\Core\Session\CurrentUserFactory $current_user
+   *   The current user factory.
    */
-  public function __construct(PrivateKey $private_key) {
+  public function __construct(PrivateKey $private_key, CurrentUserFactory $current_user) {
     $this->privateKey = $private_key;
-  }
-
-  /**
-   * Sets the current user.
-   *
-   * @param \Drupal\Core\Session\AccountInterface|null $current_user
-   *  The current user service.
-   */
-  public function setCurrentUser(AccountInterface $current_user = NULL) {
     $this->currentUser = $current_user;
   }
 
@@ -84,7 +77,7 @@ public function get($value = '') {
    *   is TRUE, the return value will always be TRUE for anonymous users.
    */
   public function validate($token, $value = '', $skip_anonymous = FALSE) {
-    return ($skip_anonymous && $this->currentUser->isAnonymous()) || ($token === $this->get($value));
+    return ($skip_anonymous && $this->currentUser->get()->isAnonymous()) || ($token === $this->get($value));
   }
 
 }
diff --git a/core/lib/Drupal/Core/Authentication/AuthenticationManager.php b/core/lib/Drupal/Core/Authentication/AuthenticationManager.php
index d3630c4..3f58518 100644
--- a/core/lib/Drupal/Core/Authentication/AuthenticationManager.php
+++ b/core/lib/Drupal/Core/Authentication/AuthenticationManager.php
@@ -54,6 +54,13 @@ class AuthenticationManager implements AuthenticationProviderInterface, Authenti
   protected $triggeredProviderId = '';
 
   /**
+   * The currently authenticated user account.
+   *
+   * @var \Drupal\Core\Session\UserSession
+   */
+  protected $account;
+
+  /**
    * Adds a provider to the array of registered providers.
    *
    * @param string $provider_id
@@ -83,23 +90,23 @@ public function applies(Request $request) {
    * {@inheritdoc}
    */
   public function authenticate(Request $request) {
-    global $user;
-
-    $account = NULL;
+    if (isset($this->account)) {
+      return $this->account;
+    }
 
-    // Iterate the availlable providers.
+    // Iterate the available providers.
     foreach ($this->getSortedProviders() as $provider_id => $provider) {
       if ($provider->applies($request)) {
         // Try to authenticate with this provider, skipping all others.
-        $account = $provider->authenticate($request);
+        $this->account = $provider->authenticate($request);
         $this->triggeredProviderId = $provider_id;
         break;
       }
     }
 
     // No provider returned a valid account, so set the user to anonymous.
-    if (!$account) {
-      $account = drupal_anonymous_user();
+    if (!$this->account) {
+      $this->account = drupal_anonymous_user();
     }
 
     // No provider was fired, so assume the one with the least priority
@@ -115,9 +122,10 @@ public function authenticate(Request $request) {
     // The global $user object is included for backward compatibility only and
     // should be considered deprecated.
     // @todo Remove this line once global $user is no longer used.
-    $user = $account;
+    global $user;
+    $user = $this->account;
 
-    return $account;
+    return $this->account;
   }
 
   /**
diff --git a/core/lib/Drupal/Core/Controller/ControllerBase.php b/core/lib/Drupal/Core/Controller/ControllerBase.php
index 23a2cac..dae06d4 100644
--- a/core/lib/Drupal/Core/Controller/ControllerBase.php
+++ b/core/lib/Drupal/Core/Controller/ControllerBase.php
@@ -241,7 +241,7 @@ public function l($text, $route_name, array $parameters = array(), array $option
    */
   protected function currentUser() {
     if (!$this->currentUser) {
-      $this->currentUser = $this->container()->get('current_user');
+      $this->currentUser = $this->container()->get('current_user')->get();
     }
     return $this->currentUser;
   }
diff --git a/core/lib/Drupal/Core/Cron.php b/core/lib/Drupal/Core/Cron.php
index 1fe9727..4128b4b 100644
--- a/core/lib/Drupal/Core/Cron.php
+++ b/core/lib/Drupal/Core/Cron.php
@@ -11,6 +11,7 @@
 use Drupal\Core\KeyValueStore\StateInterface;
 use Drupal\Core\Lock\LockBackendInterface;
 use Drupal\Core\Queue\QueueFactory;
+use Drupal\Core\Session\CurrentUserFactory;
 use Drupal\Core\Session\UserSession;
 
 /**
@@ -47,6 +48,13 @@ class Cron implements CronInterface {
   protected $state;
 
   /**
+   * The current user factory.
+   *
+   * @var \Drupal\Core\Session\CurrentUserFactory $current_user
+   */
+  protected $currentUser;
+
+  /**
    * Constructs a cron object.
    *
    * @param \Drupal\Core\Extension\ModuleHandlerInterface $module_handler
@@ -57,12 +65,15 @@ class Cron implements CronInterface {
    *   The queue service.
    * @param \Drupal\Core\KeyValueStore\StateInterface $state
    *   The state service.
+   * @param \Drupal\Core\Session\CurrentUserFactory $current_user
+   *   The current user factory.
    */
-  public function __construct(ModuleHandlerInterface $module_handler, LockBackendInterface $lock, QueueFactory $queue_factory, StateInterface $state) {
+  public function __construct(ModuleHandlerInterface $module_handler, LockBackendInterface $lock, QueueFactory $queue_factory, StateInterface $state, CurrentUserFactory $current_user) {
     $this->moduleHandler = $module_handler;
     $this->lock = $lock;
     $this->queueFactory = $queue_factory;
     $this->state = $state;
+    $this->currentUser = $current_user;
   }
 
   /**
@@ -78,10 +89,10 @@ public function run() {
 
     // Force the current user to anonymous to ensure consistent permissions on
     // cron runs.
-    // @todo This currently does not work, as it will not affect the current
-    //   user being injected into services.
-    $original_user = $GLOBALS['user'];
-    $GLOBALS['user'] = new UserSession();
+    $original_user = $this->currentUser->get();
+    $anonymous_user = new UserSession();
+    $this->currentUser->set($anonymous_user);
+    $GLOBALS['user'] = $anonymous_user;
 
     // Try to allocate enough time to run all the hook_cron implementations.
     drupal_set_time_limit(240);
@@ -147,8 +158,7 @@ public function run() {
     }
 
     // Restore the user.
-    // @todo This currently does not work, as it will not affect the current
-    //   user being injected into services.
+    $this->currentUser->set($original_user);
     $GLOBALS['user'] = $original_user;
     drupal_save_session($original_session_saving);
 
diff --git a/core/lib/Drupal/Core/EventSubscriber/AccessSubscriber.php b/core/lib/Drupal/Core/EventSubscriber/AccessSubscriber.php
index 0c31999..0dc412e 100644
--- a/core/lib/Drupal/Core/EventSubscriber/AccessSubscriber.php
+++ b/core/lib/Drupal/Core/EventSubscriber/AccessSubscriber.php
@@ -9,6 +9,7 @@
 
 use Drupal\Core\Access\AccessManager;
 use Drupal\Core\Session\AccountInterface;
+use Drupal\Core\Session\CurrentUserFactory;
 use Symfony\Cmf\Component\Routing\RouteObjectInterface;
 use Symfony\Component\HttpKernel\KernelEvents;
 use Symfony\Component\HttpKernel\HttpKernelInterface;
@@ -22,9 +23,9 @@
 class AccessSubscriber implements EventSubscriberInterface {
 
   /**
-   * The current user.
+   * The current user factory.
    *
-   * @var \Drupal\Core\Session\AccountInterface
+   * @var \Drupal\Core\Session\CurrentUserFactory
    */
   protected $currentUser;
 
@@ -41,10 +42,10 @@ class AccessSubscriber implements EventSubscriberInterface {
    * @param \Drupal\Core\Access\AccessManager $access_manager
    *   The access check manager that will be responsible for applying
    *   AccessCheckers against routes.
-   * @param \Drupal\Core\Session\AccountInterface $current_user
-   *   The current user.
+   * @param \Drupal\Core\Session\CurrentUserFactory $current_user
+   *   The current user factory.
    */
-  public function __construct(AccessManager $access_manager, AccountInterface $current_user) {
+  public function __construct(AccessManager $access_manager, CurrentUserFactory $current_user) {
     $this->accessManager = $access_manager;
     $this->currentUser = $current_user;
   }
@@ -74,7 +75,7 @@ public function onKernelRequestAccessCheck(GetResponseEvent $event) {
     // Wrap this in a try/catch to ensure the '_controller_request' attribute
     // can always be removed.
     try {
-      $access = $this->accessManager->check($request->attributes->get(RouteObjectInterface::ROUTE_OBJECT), $request, $this->currentUser);
+      $access = $this->accessManager->check($request->attributes->get(RouteObjectInterface::ROUTE_OBJECT), $request, $this->currentUser->get());
     }
     catch (\Exception $e) {
       $request->attributes->remove('_controller_request');
@@ -89,16 +90,6 @@ public function onKernelRequestAccessCheck(GetResponseEvent $event) {
   }
 
   /**
-   * Sets the current user.
-   *
-   * @param \Drupal\Core\Session\AccountInterface|null $current_user
-   *  The current user service.
-   */
-  public function setCurrentUser(AccountInterface $current_user = NULL) {
-    $this->currentUser = $current_user;
-  }
-
-  /**
    * Registers the methods in this class that should be listeners.
    *
    * @return array
diff --git a/core/lib/Drupal/Core/Menu/ContextualLinkManager.php b/core/lib/Drupal/Core/Menu/ContextualLinkManager.php
index 5141f5c..dbca7f6 100644
--- a/core/lib/Drupal/Core/Menu/ContextualLinkManager.php
+++ b/core/lib/Drupal/Core/Menu/ContextualLinkManager.php
@@ -18,6 +18,7 @@
 use Drupal\Core\Plugin\Discovery\YamlDiscovery;
 use Drupal\Core\Plugin\Factory\ContainerFactory;
 use Drupal\Core\Session\AccountInterface;
+use Drupal\Core\Session\CurrentUserFactory;
 
 /**
  * Defines a contextual link plugin manager to deal with contextual links.
@@ -63,11 +64,11 @@ class ContextualLinkManager extends DefaultPluginManager implements ContextualLi
   protected $accessManager;
 
   /**
-   * The current user.
+   * The current user factory.
    *
-   * @var \Drupal\Core\Session\AccountInterface
+   * @var \Drupal\Core\Session\CurrentUserFactory
    */
-  protected $account;
+  protected $currentUser;
 
   /**
    * A static cache of all the contextual link plugins by group name.
@@ -89,17 +90,17 @@ class ContextualLinkManager extends DefaultPluginManager implements ContextualLi
    *   The language manager.
    * @param \Drupal\Core\Access\AccessManager $access_manager
    *   The access manager.
-   * @param \Drupal\Core\Session\AccountInterface $account
-   *   The current user.
+   * @param \Drupal\Core\Session\CurrentUserFactory $account
+   *   The current user factory.
    */
-  public function __construct(ControllerResolverInterface $controller_resolver, ModuleHandlerInterface $module_handler, CacheBackendInterface $cache_backend, LanguageManager $language_manager, AccessManager $access_manager, AccountInterface $account) {
+  public function __construct(ControllerResolverInterface $controller_resolver, ModuleHandlerInterface $module_handler, CacheBackendInterface $cache_backend, LanguageManager $language_manager, AccessManager $access_manager, CurrentUserFactory $current_user) {
     $this->discovery = new YamlDiscovery('contextual_links', $module_handler->getModuleDirectories());
     $this->discovery = new ContainerDerivativeDiscoveryDecorator($this->discovery);
     $this->factory = new ContainerFactory($this);
 
     $this->controllerResolver = $controller_resolver;
     $this->accessManager = $access_manager;
-    $this->account = $account;
+    $this->currentUser = $current_user;
     $this->alterInfo($module_handler, 'contextual_links_plugins');
     $this->setCacheBackend($cache_backend, $language_manager, 'contextual_links_plugins');
   }
@@ -155,7 +156,7 @@ public function getContextualLinksArrayByGroup($group_name, array $route_paramet
       $route_name = $plugin->getRouteName();
 
       // Check access.
-      if (!$this->accessManager->checkNamedRoute($route_name, $route_parameters, $this->account)) {
+      if (!$this->accessManager->checkNamedRoute($route_name, $route_parameters, $this->currentUser->get())) {
         continue;
       }
 
diff --git a/core/lib/Drupal/Core/Menu/LocalActionManager.php b/core/lib/Drupal/Core/Menu/LocalActionManager.php
index 32ae80e..93d1829 100644
--- a/core/lib/Drupal/Core/Menu/LocalActionManager.php
+++ b/core/lib/Drupal/Core/Menu/LocalActionManager.php
@@ -18,9 +18,9 @@
 use Drupal\Core\Plugin\Discovery\YamlDiscovery;
 use Drupal\Core\Plugin\Factory\ContainerFactory;
 use Drupal\Core\Routing\RouteProviderInterface;
+use Drupal\Core\Session\CurrentUserFactory;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpKernel\Controller\ControllerResolverInterface;
-use Drupal\Core\Session\AccountInterface;
 
 /**
  * Manages discovery and instantiation of menu local action plugins.
@@ -85,11 +85,11 @@ class LocalActionManager extends DefaultPluginManager {
   protected $accessManager;
 
   /**
-   * The current user.
+   * The current user factory.
    *
-   * @var \Drupal\Core\Session\AccountInterface
+   * @var \Drupal\Core\Session\CurrentUserFactory
    */
-  protected $account;
+  protected $currentUser;
 
 /**
    * The plugin instances.
@@ -116,8 +116,10 @@ class LocalActionManager extends DefaultPluginManager {
    *   The language manager.
    * @param \Drupal\Core\Access\AccessManager $access_manager
    *   The access manager.
+   * @param \Drupal\Core\Session\CurrentUserFactory $current_user
+   *   The current user factory.
    */
-  public function __construct(ControllerResolverInterface $controller_resolver, Request $request, RouteProviderInterface $route_provider, ModuleHandlerInterface $module_handler, CacheBackendInterface $cache_backend, LanguageManager $language_manager, AccessManager $access_manager, AccountInterface $account) {
+  public function __construct(ControllerResolverInterface $controller_resolver, Request $request, RouteProviderInterface $route_provider, ModuleHandlerInterface $module_handler, CacheBackendInterface $cache_backend, LanguageManager $language_manager, AccessManager $access_manager, CurrentUserFactory $current_user) {
     // Skip calling the parent constructor, since that assumes annotation-based
     // discovery.
     $this->discovery = new YamlDiscovery('local_actions', $module_handler->getModuleDirectories());
@@ -125,7 +127,7 @@ public function __construct(ControllerResolverInterface $controller_resolver, Re
     $this->factory = new ContainerFactory($this);
     $this->routeProvider = $route_provider;
     $this->accessManager = $access_manager;
-    $this->account = $account;
+    $this->currentUser = $current_user;
     $this->controllerResolver = $controller_resolver;
     $this->request = $request;
     $this->alterInfo($module_handler, 'menu_local_actions');
@@ -190,7 +192,7 @@ public function getActionsForRoute($route_appears) {
           'route_parameters' => $route_parameters,
           'localized_options' => $plugin->getOptions($this->request),
         ),
-        '#access' => $this->accessManager->checkNamedRoute($route_name, $route_parameters, $this->account),
+        '#access' => $this->accessManager->checkNamedRoute($route_name, $route_parameters, $this->currentUser->get()),
         '#weight' => $plugin->getWeight(),
       );
     }
diff --git a/core/lib/Drupal/Core/Menu/LocalTaskManager.php b/core/lib/Drupal/Core/Menu/LocalTaskManager.php
index a436d57..ad4145f 100644
--- a/core/lib/Drupal/Core/Menu/LocalTaskManager.php
+++ b/core/lib/Drupal/Core/Menu/LocalTaskManager.php
@@ -19,7 +19,7 @@
 use Drupal\Core\Plugin\Discovery\YamlDiscovery;
 use Drupal\Core\Plugin\Factory\ContainerFactory;
 use Drupal\Core\Routing\RouteProviderInterface;
-use Drupal\Core\Session\AccountInterface;
+use Drupal\Core\Session\CurrentUserFactory;
 use Symfony\Component\HttpFoundation\Request;
 
 /**
@@ -91,11 +91,11 @@ class LocalTaskManager extends DefaultPluginManager {
   protected $accessManager;
 
   /**
-   * The current user.
+   * The current user factory.
    *
-   * @var \Drupal\Core\Session\AccountInterface
+   * @var \Drupal\Core\Session\CurrentUserFactory
    */
-  protected $account;
+  protected $currentUser;
 
   /**
    * Constructs a \Drupal\Core\Menu\LocalTaskManager object.
@@ -114,10 +114,10 @@ class LocalTaskManager extends DefaultPluginManager {
    *   The language manager.
    * @param \Drupal\Core\Access\AccessManager $access_manager
    *   The access manager.
-   * @param \Drupal\Core\Session\AccountInterface $account
-   *   The current user.
+   * @param \Drupal\Core\Session\CurrentUserFactory $current_user
+   *   The current user factory.
    */
-  public function __construct(ControllerResolverInterface $controller_resolver, Request $request, RouteProviderInterface $route_provider, ModuleHandlerInterface $module_handler, CacheBackendInterface $cache, LanguageManager $language_manager, AccessManager $access_manager, AccountInterface $account) {
+  public function __construct(ControllerResolverInterface $controller_resolver, Request $request, RouteProviderInterface $route_provider, ModuleHandlerInterface $module_handler, CacheBackendInterface $cache, LanguageManager $language_manager, AccessManager $access_manager, CurrentUserFactory $current_user) {
     $this->discovery = new YamlDiscovery('local_tasks', $module_handler->getModuleDirectories());
     $this->discovery = new ContainerDerivativeDiscoveryDecorator($this->discovery);
     $this->factory = new ContainerFactory($this);
@@ -125,7 +125,7 @@ public function __construct(ControllerResolverInterface $controller_resolver, Re
     $this->request = $request;
     $this->routeProvider = $route_provider;
     $this->accessManager = $access_manager;
-    $this->account = $account;
+    $this->currentUser = $current_user;
     $this->alterInfo($module_handler, 'local_tasks');
     $this->setCacheBackend($cache, $language_manager, 'local_task_plugins', array('local_task' => TRUE));
   }
@@ -286,7 +286,7 @@ public function getTasksBuild($current_route_name) {
         $route_parameters = $child->getRouteParameters($this->request);
 
         // Find out whether the user has access to the task.
-        $access = $this->accessManager->checkNamedRoute($route_name, $route_parameters, $this->account);
+        $access = $this->accessManager->checkNamedRoute($route_name, $route_parameters, $this->currentUser->get());
         if ($access) {
           $active = $this->isRouteActive($current_route_name, $route_name, $route_parameters);
 
diff --git a/core/lib/Drupal/Core/Session/CurrentUserFactory.php b/core/lib/Drupal/Core/Session/CurrentUserFactory.php
new file mode 100644
index 0000000..99405f4
--- /dev/null
+++ b/core/lib/Drupal/Core/Session/CurrentUserFactory.php
@@ -0,0 +1,74 @@
+<?php
+
+/**
+ * @file
+ * Contains \Drupal\Core\Session\CurrentUserFactory.
+ */
+
+namespace Drupal\Core\Session;
+
+use Drupal\Core\Authentication\AuthenticationManagerInterface;
+use Symfony\Component\HttpFoundation\Request;
+
+/**
+ * A factory class to get the currently authenticated user.
+ */
+class CurrentUserFactory {
+
+  /**
+   * The authentication manager.
+   *
+   * @var \Drupal\Core\Authentication\AuthenticationManagerInterface
+   */
+  protected $authManager;
+
+  /**
+   * The current request.
+   *
+   * @var \Symfony\Component\HttpFoundation\Request
+   */
+  protected $request;
+
+  /**
+   * The current user account.
+   *
+   * @var \Drupal\Core\Session\AccountInterface
+   */
+  protected $account;
+
+  /**
+   * Constructs a CurrentUserFactory object.
+   *
+   * @param \Drupal\Core\Authentication\AuthenticationManagerInterface $auth_manager
+   *   The authentication manager.
+   */
+  public function __construct(AuthenticationManagerInterface $auth_manager, Request $request) {
+    $this->authManager = $auth_manager;
+    $this->request = $request;
+  }
+
+  /**
+   * Gets the current account.
+   *
+   * @return \Drupal\Core\Session\AccountInterface
+   *   The current account.
+   */
+  public function get() {
+    if (empty($this->account)) {
+      $this->set($this->authManager->authenticate($this->request));
+    }
+
+    return $this->account;
+  }
+
+  /**
+   * Sets the current user.
+   *
+   * @param \Drupal\Core\Session\AccountInterface $account
+   *   The account to set.
+   */
+  public function set(AccountInterface $account) {
+    $this->account = $account;
+  }
+
+}
diff --git a/core/modules/book/lib/Drupal/book/BookBreadcrumbBuilder.php b/core/modules/book/lib/Drupal/book/BookBreadcrumbBuilder.php
index 6dd54ff..453c18e 100644
--- a/core/modules/book/lib/Drupal/book/BookBreadcrumbBuilder.php
+++ b/core/modules/book/lib/Drupal/book/BookBreadcrumbBuilder.php
@@ -10,7 +10,7 @@
 use Drupal\Core\Access\AccessManager;
 use Drupal\Core\Breadcrumb\BreadcrumbBuilderBase;
 use Drupal\Core\Entity\EntityManagerInterface;
-use Drupal\Core\Session\AccountInterface;
+use Drupal\Core\Session\CurrentUserFactory;
 use Drupal\node\NodeInterface;
 
 /**
@@ -33,11 +33,11 @@ class BookBreadcrumbBuilder extends BreadcrumbBuilderBase {
   protected $accessManager;
 
   /**
-   * The current user account.
+   * The current user factory.
    *
-   * @var \Drupal\Core\Session\AccountInterface
+   * @var \Drupal\Core\Session\CurrentUserFactory
    */
-  protected $account;
+  protected $currentUser;
 
   /**
    * Constructs the BookBreadcrumbBuilder.
@@ -46,13 +46,13 @@ class BookBreadcrumbBuilder extends BreadcrumbBuilderBase {
    *   The entity manager service.
    * @param \Drupal\Core\Access\AccessManager $access_manager
    *   The access manager.
-   * @param \Drupal\Core\Session\AccountInterface $account
-   *   The current user account.
+   * @param \Drupal\Core\Session\CurrentUserFactory $current_user
+   *   The current user factory.
    */
-  public function __construct(EntityManagerInterface $entity_manager, AccessManager $access_manager, AccountInterface $account) {
+  public function __construct(EntityManagerInterface $entity_manager, AccessManager $access_manager, CurrentUserFactory $current_user) {
     $this->menuLinkStorage = $entity_manager->getStorageController('menu_link');
     $this->accessManager = $access_manager;
-    $this->account = $account;
+    $this->currentUser = $current_user;
   }
 
   /**
@@ -82,7 +82,7 @@ public function build(array $attributes) {
       $depth = 1;
       while (!empty($book['p' . ($depth + 1)])) {
         if (!empty($menu_links[$book['p' . $depth]]) && ($menu_link = $menu_links[$book['p' . $depth]])) {
-          if ($this->accessManager->checkNamedRoute($menu_link->route_name, $menu_link->route_parameters, $this->account)) {
+          if ($this->accessManager->checkNamedRoute($menu_link->route_name, $menu_link->route_parameters, $this->currentUser->get())) {
             $links[] = $this->l($menu_link->label(), $menu_link->route_name, $menu_link->route_parameters, $menu_link->options);
           }
         }
diff --git a/core/modules/comment/lib/Drupal/comment/CommentManager.php b/core/modules/comment/lib/Drupal/comment/CommentManager.php
index e1075b3..e975afc 100644
--- a/core/modules/comment/lib/Drupal/comment/CommentManager.php
+++ b/core/modules/comment/lib/Drupal/comment/CommentManager.php
@@ -12,7 +12,7 @@
 use Drupal\Core\Entity\EntityInterface;
 use Drupal\Core\Entity\EntityManagerInterface;
 use Drupal\Core\Routing\UrlGeneratorInterface;
-use Drupal\Core\Session\AccountInterface;
+use Drupal\Core\Session\CurrentUserFactory;
 use Drupal\Core\StringTranslation\TranslationInterface;
 use Drupal\field\FieldInfo;
 
@@ -36,9 +36,9 @@ class CommentManager implements CommentManagerInterface {
   protected $entityManager;
 
   /**
-   * The current user.
+   * The current user factory.
    *
-   * @var \Drupal\Core\Session\AccountInterface $current_user
+   * @var \Drupal\Core\Session\CurrentUserFactory $current_user
    */
   protected $currentUser;
 
@@ -77,8 +77,8 @@ class CommentManager implements CommentManagerInterface {
    *   The field info service.
    * @param \Drupal\Core\Entity\EntityManagerInterface $entity_manager
    *   The entity manager service.
-   * @param \Drupal\Core\Session\AccountInterface $current_user
-   *   The current user.
+   * @param \Drupal\Core\Session\CurrentUserFactory $current_user
+   *   The current user factory.
    * @param \Drupal\Core\Config\ConfigFactory $config_factory
    *   The config factory.
    * @param \Drupal\Core\StringTranslation\TranslationInterface $translation_manager
@@ -86,7 +86,7 @@ class CommentManager implements CommentManagerInterface {
    * @param \Drupal\Core\Routing\UrlGeneratorInterface $url_generator
    *   The url generator service.
    */
-  public function __construct(FieldInfo $field_info, EntityManagerInterface $entity_manager, AccountInterface $current_user, ConfigFactory $config_factory, TranslationInterface $translation_manager, UrlGeneratorInterface $url_generator) {
+  public function __construct(FieldInfo $field_info, EntityManagerInterface $entity_manager, CurrentUserFactory $current_user, ConfigFactory $config_factory, TranslationInterface $translation_manager, UrlGeneratorInterface $url_generator) {
     $this->fieldInfo = $field_info;
     $this->entityManager = $entity_manager;
     $this->currentUser = $current_user;
@@ -256,7 +256,7 @@ public function getFieldUIPageTitle($commented_entity_type, $field_name) {
    * {@inheritdoc}
    */
   public function forbiddenMessage(EntityInterface $entity, $field_name) {
-    if ($this->currentUser->isAnonymous()) {
+    if ($this->currentUser->get()->isAnonymous()) {
       if (!isset($this->authenticatedCanPostComments)) {
         // We only output a link if we are certain that users will get the
         // permission to post comments by logging in.
diff --git a/core/modules/node/lib/Drupal/node/Plugin/Search/NodeSearch.php b/core/modules/node/lib/Drupal/node/Plugin/Search/NodeSearch.php
index c3acc23..fae3628 100644
--- a/core/modules/node/lib/Drupal/node/Plugin/Search/NodeSearch.php
+++ b/core/modules/node/lib/Drupal/node/Plugin/Search/NodeSearch.php
@@ -18,6 +18,7 @@
 use Drupal\Core\Session\AccountInterface;
 use Drupal\Core\Access\AccessibleInterface;
 use Drupal\Core\Database\Query\Condition;
+use Drupal\Core\Session\CurrentUserFactory;
 use Drupal\search\Plugin\ConfigurableSearchPluginBase;
 use Drupal\search\Plugin\SearchIndexingInterface;
 use Symfony\Component\DependencyInjection\ContainerInterface;
@@ -68,11 +69,11 @@ class NodeSearch extends ConfigurableSearchPluginBase implements AccessibleInter
   protected $state;
 
   /**
-   * The Drupal account to use for checking for access to advanced search.
+   * The current user factory.
    *
-   * @var \Drupal\Core\Session\AccountInterface
+   * @var \Drupal\Core\Session\CurrentUserFactory
    */
-  protected $account;
+  protected $currentUser;
 
   /**
    * An array of additional rankings from hook_ranking().
@@ -137,16 +138,17 @@ static public function create(ContainerInterface $container, array $configuratio
    *   A config object for 'search.settings'.
    * @param \Drupal\Core\KeyValueStore\StateInterface $state
    *   The Drupal state object used to set 'node.cron_last'.
-   * @param \Drupal\Core\Session\AccountInterface $account
-   *   The $account object to use for checking for access to advanced search.
+   * @param \Drupal\Core\Session\CurrentUserFactory $current_user
+   *   The current user factory to use for checking for access to advanced
+   *   search.
    */
-  public function __construct(array $configuration, $plugin_id, array $plugin_definition, Connection $database, EntityManagerInterface $entity_manager, ModuleHandlerInterface $module_handler, Config $search_settings, StateInterface $state, AccountInterface $account = NULL) {
+  public function __construct(array $configuration, $plugin_id, array $plugin_definition, Connection $database, EntityManagerInterface $entity_manager, ModuleHandlerInterface $module_handler, Config $search_settings, StateInterface $state, CurrentUserFactory $current_user) {
     $this->database = $database;
     $this->entityManager = $entity_manager;
     $this->moduleHandler = $module_handler;
     $this->searchSettings = $search_settings;
     $this->state = $state;
-    $this->account = $account;
+    $this->currentUser = $current_user;
     parent::__construct($configuration, $plugin_id, $plugin_definition);
   }
 
@@ -371,13 +373,14 @@ public function indexStatus() {
    * {@inheritdoc}
    */
   public function searchFormAlter(array &$form, array &$form_state) {
+    $current_user = $this->currentUser->get();
     // Add keyword boxes.
     $form['advanced'] = array(
       '#type' => 'details',
       '#title' => t('Advanced search'),
       '#collapsed' => TRUE,
       '#attributes' => array('class' => array('search-advanced')),
-      '#access' => $this->account && $this->account->hasPermission('use advanced search'),
+      '#access' => $current_user && $current_user->hasPermission('use advanced search'),
     );
     $form['advanced']['keywords-fieldset'] = array(
       '#type' => 'fieldset',
diff --git a/core/modules/simpletest/lib/Drupal/simpletest/TestBase.php b/core/modules/simpletest/lib/Drupal/simpletest/TestBase.php
index bca0239..69859e6 100644
--- a/core/modules/simpletest/lib/Drupal/simpletest/TestBase.php
+++ b/core/modules/simpletest/lib/Drupal/simpletest/TestBase.php
@@ -8,6 +8,7 @@
 namespace Drupal\simpletest;
 
 use Drupal\Component\Utility\Random;
+use Drupal\Core\Authentication\AuthenticationManager;
 use Drupal\Core\Database\Database;
 use Drupal\Component\Utility\Settings;
 use Drupal\Core\Config\ConfigImporter;
@@ -17,6 +18,7 @@
 use Drupal\Core\Config\StorageInterface;
 use Drupal\Core\DrupalKernel;
 use Drupal\Core\Language\Language;
+use Drupal\Core\Session\CurrentUserFactory;
 use Drupal\Core\StreamWrapper\PublicStream;
 use Drupal\Core\Utility\Error;
 use Symfony\Component\HttpFoundation\Request;
@@ -1016,7 +1018,9 @@ private function prepareEnvironment() {
 
     $request = Request::create('/');
     $this->container->set('request', $request);
-    $this->container->set('current_user', $GLOBALS['user']);
+    $current_user = new CurrentUserFactory(new AuthenticationManager(), $request);
+    $current_user->set($GLOBALS['user']);
+    $this->container->set('current_user', $current_user);
 
     \Drupal::setContainer($this->container);
 
@@ -1095,7 +1099,9 @@ protected function rebuildContainer() {
     $this->container = \Drupal::getContainer();
     // The global $user is set in TestBase::prepareEnvironment().
     $this->container->set('request', $request);
-    $this->container->set('current_user', $GLOBALS['user']);
+    $current_user = new CurrentUserFactory(new AuthenticationManager(), $request);
+    $current_user->set($GLOBALS['user']);
+    $this->container->set('current_user', $current_user);
   }
 
   /**
diff --git a/core/modules/simpletest/lib/Drupal/simpletest/WebTestBase.php b/core/modules/simpletest/lib/Drupal/simpletest/WebTestBase.php
index ec40407..80bb053 100644
--- a/core/modules/simpletest/lib/Drupal/simpletest/WebTestBase.php
+++ b/core/modules/simpletest/lib/Drupal/simpletest/WebTestBase.php
@@ -644,10 +644,7 @@ protected function drupalLogin(AccountInterface $account) {
     $pass = $this->assert($this->drupalUserIsLoggedIn($account), format_string('User %name successfully logged in.', array('%name' => $account->getUsername())), 'User login');
     if ($pass) {
       $this->loggedInUser = $account;
-      $this->container->set('current_user', $account);
-      // @todo Temporary workaround for not being able to use synchronized
-      //   services in non dumped container.
-      $this->container->get('access_subscriber')->setCurrentUser($account);
+      $this->container->get('current_user')->set($account);
     }
   }
 
@@ -692,7 +689,7 @@ protected function drupalLogout() {
       // @see WebTestBase::drupalUserIsLoggedIn()
       unset($this->loggedInUser->session_id);
       $this->loggedInUser = FALSE;
-      $this->container->set('current_user', drupal_anonymous_user());
+      $this->container->get('current_user')->set(drupal_anonymous_user());
     }
   }
 
diff --git a/core/modules/user/lib/Drupal/user/EventSubscriber/MaintenanceModeSubscriber.php b/core/modules/user/lib/Drupal/user/EventSubscriber/MaintenanceModeSubscriber.php
index 0a42c91..d96ee81 100644
--- a/core/modules/user/lib/Drupal/user/EventSubscriber/MaintenanceModeSubscriber.php
+++ b/core/modules/user/lib/Drupal/user/EventSubscriber/MaintenanceModeSubscriber.php
@@ -7,6 +7,7 @@
 
 namespace Drupal\user\EventSubscriber;
 
+use Drupal\Core\Session\CurrentUserFactory;
 use Symfony\Component\EventDispatcher\EventSubscriberInterface;
 use Symfony\Component\HttpFoundation\RedirectResponse;
 use Symfony\Component\HttpKernel\Event\GetResponseEvent;
@@ -18,13 +19,30 @@
 class MaintenanceModeSubscriber implements EventSubscriberInterface {
 
   /**
+   * The current user factory.
+   *
+   * @var \Drupal\Core\Session\CurrentUserFactory $current_user
+   */
+  protected $currentUser;
+
+  /**
+   * Constructs a MaintenanceModeSubscriber object.
+   *
+   * @param \Drupal\Core\Session\CurrentUserFactory $current_user
+   *   The current user.
+   */
+  public function __construct(CurrentUserFactory $current_user) {
+    $this->currentUser = $current_user;
+  }
+
+  /**
    * Determine whether the page is configured to be offline.
    *
    * @param \Symfony\Component\HttpKernel\Event\GetResponseEvent $event
    *   The event to process.
    */
   public function onKernelRequestMaintenance(GetResponseEvent $event) {
-    $user = \Drupal::currentUser();
+    $user = $this->currentUser->get();
     $request = $event->getRequest();
     $site_status = $request->attributes->get('_maintenance');
     $path = $request->attributes->get('_system_path');
@@ -37,7 +55,7 @@ public function onKernelRequestMaintenance(GetResponseEvent $event) {
         return;
       }
 
-      if (user_is_anonymous()) {
+      if ($user->isAnonymous()) {
         switch ($path) {
           case 'user':
             // Forward anonymous user to login page.
diff --git a/core/modules/user/lib/Drupal/user/Plugin/Search/UserSearch.php b/core/modules/user/lib/Drupal/user/Plugin/Search/UserSearch.php
index 518d9c0..4fc3363 100644
--- a/core/modules/user/lib/Drupal/user/Plugin/Search/UserSearch.php
+++ b/core/modules/user/lib/Drupal/user/Plugin/Search/UserSearch.php
@@ -12,6 +12,7 @@
 use Drupal\Core\Extension\ModuleHandlerInterface;
 use Drupal\Core\Session\AccountInterface;
 use Drupal\Core\Access\AccessibleInterface;
+use Drupal\Core\Session\CurrentUserFactory;
 use Drupal\search\Plugin\SearchPluginBase;
 use Symfony\Component\DependencyInjection\ContainerInterface;
 
@@ -47,9 +48,9 @@ class UserSearch extends SearchPluginBase implements AccessibleInterface {
   protected $moduleHandler;
 
   /**
-   * The current user.
+   * The current user factory.
    *
-   * @var \Drupal\Core\Session\AccountInterface
+   * @var \Drupal\Core\Session\CurrentUserFactory
    */
   protected $currentUser;
 
@@ -77,8 +78,8 @@ static public function create(ContainerInterface $container, array $configuratio
    *   The entity manager.
    * @param ModuleHandlerInterface $module_handler
    *   The module handler.
-   * @param \Drupal\Core\Session\AccountInterface $current_user
-   *   The current user.
+   * @param \Drupal\Core\Session\CurrentUserFactory $current_user
+   *   The current user factory.
    * @param array $configuration
    *   A configuration array containing information about the plugin instance.
    * @param string $plugin_id
@@ -86,7 +87,7 @@ static public function create(ContainerInterface $container, array $configuratio
    * @param array $plugin_definition
    *   The plugin implementation definition.
    */
-  public function __construct(Connection $database, EntityManagerInterface $entity_manager, ModuleHandlerInterface $module_handler, AccountInterface $current_user, array $configuration, $plugin_id, array $plugin_definition) {
+  public function __construct(Connection $database, EntityManagerInterface $entity_manager, ModuleHandlerInterface $module_handler, CurrentUserFactory $current_user, array $configuration, $plugin_id, array $plugin_definition) {
     $this->database = $database;
     $this->entityManager = $entity_manager;
     $this->moduleHandler = $module_handler;
@@ -105,7 +106,9 @@ public function access($operation = 'view', AccountInterface $account = NULL) {
    * {@inheritdoc}
    */
   public function execute() {
+    $current_user = $this->currentUser->get();
     $results = array();
+
     if (!$this->isSearchExecutable()) {
       return $results;
     }
@@ -116,7 +119,7 @@ public function execute() {
       ->select('users')
       ->extend('Drupal\Core\Database\Query\PagerSelectExtender');
     $query->fields('users', array('uid'));
-    if ($this->currentUser->hasPermission('administer users')) {
+    if ($current_user->hasPermission('administer users')) {
       // Administrators can also search in the otherwise private email field, and
       // they don't need to be restricted to only active users.
       $query->fields('users', array('mail'));
@@ -142,7 +145,7 @@ public function execute() {
         'title' => $account->getUsername(),
         'link' => url('user/' . $account->id(), array('absolute' => TRUE)),
       );
-      if ($this->currentUser->hasPermission('administer users')) {
+      if ($current_user->hasPermission('administer users')) {
         $result['title'] .= ' (' . $account->getEmail() . ')';
       }
       $results[] = $result;
diff --git a/core/modules/user/lib/Drupal/user/Theme/AdminNegotiator.php b/core/modules/user/lib/Drupal/user/Theme/AdminNegotiator.php
index faaeb40..0ac8f37 100644
--- a/core/modules/user/lib/Drupal/user/Theme/AdminNegotiator.php
+++ b/core/modules/user/lib/Drupal/user/Theme/AdminNegotiator.php
@@ -9,7 +9,7 @@
 
 use Drupal\Core\Config\ConfigFactory;
 use Drupal\Core\Entity\EntityManagerInterface;
-use Drupal\Core\Session\AccountInterface;
+use Drupal\Core\Session\CurrentUserFactory;
 use Drupal\Core\Theme\ThemeNegotiatorInterface;
 use Symfony\Component\HttpFoundation\Request;
 
@@ -19,11 +19,11 @@
 class AdminNegotiator implements ThemeNegotiatorInterface {
 
   /**
-   * The current user.
+   * The current user factory.
    *
-   * @var \Drupal\Core\Session\AccountInterface
+   * @var \Drupal\Core\Session\CurrentUserFactory
    */
-  protected $user;
+  protected $currentUser;
 
   /**
    * The config factory.
@@ -42,15 +42,15 @@ class AdminNegotiator implements ThemeNegotiatorInterface {
   /**
    * Creates a new AdminNegotiator instance.
    *
-   * @param \Drupal\Core\Session\AccountInterface $user
+   * @param \Drupal\Core\Session\CurrentUserFactory $current_user
    *   The current user.
    * @param \Drupal\Core\Config\ConfigFactory $config_factory
    *   The config factory.
    * @param \Drupal\Core\Entity\EntityManagerInterface $entity_manager
    *   The entity manager.
    */
-  public function __construct(AccountInterface $user, ConfigFactory $config_factory, EntityManagerInterface $entity_manager) {
-    $this->user = $user;
+  public function __construct(CurrentUserFactory $current_user, ConfigFactory $config_factory, EntityManagerInterface $entity_manager) {
+    $this->currentUser = $current_user;
     $this->configFactory = $config_factory;
     $this->entityManager = $entity_manager;
   }
@@ -60,7 +60,7 @@ public function __construct(AccountInterface $user, ConfigFactory $config_factor
    */
   public function applies(Request $request) {
     $path = $request->attributes->get('_system_path');
-    return ($this->entityManager->hasController('user_role', 'storage') && $this->user->hasPermission('view the administration theme') && path_is_admin($path));
+    return ($this->entityManager->hasController('user_role', 'storage') && $this->currentUser->get()->hasPermission('view the administration theme') && path_is_admin($path));
   }
 
   /**
diff --git a/core/modules/user/user.services.yml b/core/modules/user/user.services.yml
index 23d8706..7e27107 100644
--- a/core/modules/user/user.services.yml
+++ b/core/modules/user/user.services.yml
@@ -23,6 +23,7 @@ services:
     arguments: ['@database', '@config.factory', '@entity.manager', '@entity.query']
   user_maintenance_mode_subscriber:
     class: Drupal\user\EventSubscriber\MaintenanceModeSubscriber
+    arguments: ['@current_user']
     tags:
       - { name: event_subscriber }
   theme.negotiator.admin_theme:
diff --git a/core/modules/views/lib/Drupal/views/ViewExecutableFactory.php b/core/modules/views/lib/Drupal/views/ViewExecutableFactory.php
index c6f9828..827049a 100644
--- a/core/modules/views/lib/Drupal/views/ViewExecutableFactory.php
+++ b/core/modules/views/lib/Drupal/views/ViewExecutableFactory.php
@@ -7,8 +7,7 @@
 
 namespace Drupal\views;
 
-use Drupal\Core\Session\AccountInterface;
-use Drupal\views\ViewStorageInterface;
+use Drupal\Core\Session\CurrentUserFactory;
 
 /**
  * Defines the cache backend factory.
@@ -18,18 +17,18 @@ class ViewExecutableFactory {
   /**
    * Stores the current user.
    *
-   * @var \Drupal\Core\Session\AccountInterface
+   * @var \Drupal\Core\Session\CurrentUserFactory
    */
-  protected $user;
+  protected $currentUser;
 
   /**
    * Constructs a new ViewExecutableFactory
    *
-   * @param \Drupal\Core\Session\AccountInterface $user
+   * @param \Drupal\Core\Session\CurrentUserFactory $current_user
    *   The current user.
    */
-  public function __construct(AccountInterface $user) {
-    $this->user = $user;
+  public function __construct(CurrentUserFactory $current_user) {
+    $this->currentUser = $current_user;
   }
 
   /**
@@ -42,7 +41,7 @@ public function __construct(AccountInterface $user) {
    *   A ViewExecutable instance.
    */
   public function get(ViewStorageInterface $view) {
-    return new ViewExecutable($view, $this->user);
+    return new ViewExecutable($view, $this->currentUser->get());
   }
 
 }
