diff --git a/core/lib/Drupal/Core/Form/FormState.php b/core/lib/Drupal/Core/Form/FormState.php
index 9cb0b0d..ecd0147 100644
--- a/core/lib/Drupal/Core/Form/FormState.php
+++ b/core/lib/Drupal/Core/Form/FormState.php
@@ -8,6 +8,7 @@
 namespace Drupal\Core\Form;
 
 use Drupal\Component\Utility\NestedArray;
+use Drupal\Component\Utility\SafeMarkup;
 use Drupal\Core\Url;
 use Symfony\Component\HttpFoundation\Response;
 
@@ -1058,6 +1059,10 @@ public function setRedirect($route_name, array $route_parameters = array(), arra
    * {@inheritdoc}
    */
   public function setRedirectUrl(Url $url) {
+    if (!$url->access()) {
+      // @todo Use a more specific exception class.
+      throw new \Exception('Access denied for "' . $url->getRouteName() . '". Backtrace: ' .  \Drupal\Core\Utility\Error::formatBacktrace(debug_backtrace()));
+    }
     $this->redirect = $url;
     return $this;
   }
diff --git a/core/modules/action/src/Tests/BulkFormTest.php b/core/modules/action/src/Tests/BulkFormTest.php
index 88892c4..8849541 100644
--- a/core/modules/action/src/Tests/BulkFormTest.php
+++ b/core/modules/action/src/Tests/BulkFormTest.php
@@ -66,7 +66,7 @@ public function testBulkForm() {
     // Log in as a user with 'administer nodes' permission to have access to the
     // bulk operation.
     $this->drupalCreateContentType(['type' => 'page']);
-    $admin_user = $this->drupalCreateUser(['administer nodes', 'edit any page content', 'delete any page content']);
+    $admin_user = $this->drupalCreateUser(['administer nodes', 'access content overview', 'edit any page content', 'delete any page content']);
     $this->drupalLogin($admin_user);
 
     $this->drupalGet('test_bulk_form');
diff --git a/core/modules/config_translation/src/Form/ConfigTranslationFormBase.php b/core/modules/config_translation/src/Form/ConfigTranslationFormBase.php
index 9e5372f..b89d8aa 100644
--- a/core/modules/config_translation/src/Form/ConfigTranslationFormBase.php
+++ b/core/modules/config_translation/src/Form/ConfigTranslationFormBase.php
@@ -219,7 +219,7 @@ public function submitForm(array &$form, FormStateInterface $form_state) {
     }
 
     $form_state->setRedirect(
-      $this->mapper->getOverviewRoute(),
+      $this->mapper->getOverviewRouteName(),
       $this->mapper->getOverviewRouteParameters()
     );
   }
diff --git a/core/modules/content_translation/src/Tests/ContentTranslationEntityBundleUITest.php b/core/modules/content_translation/src/Tests/ContentTranslationEntityBundleUITest.php
index 2c432c4..a01980b 100644
--- a/core/modules/content_translation/src/Tests/ContentTranslationEntityBundleUITest.php
+++ b/core/modules/content_translation/src/Tests/ContentTranslationEntityBundleUITest.php
@@ -20,7 +20,7 @@ class ContentTranslationEntityBundleUITest extends WebTestBase {
 
   protected function setUp() {
     parent::setUp();
-    $user = $this->drupalCreateUser(array('access administration pages', 'administer languages', 'administer content translation', 'administer content types'));
+    $user = $this->drupalCreateUser(array('access administration pages', 'administer languages', 'administer content translation', 'administer content types', 'administer node fields'));
     $this->drupalLogin($user);
   }
 
diff --git a/core/modules/language/src/Tests/LanguageConfigurationElementTest.php b/core/modules/language/src/Tests/LanguageConfigurationElementTest.php
index a8f33aa..c8d418b 100644
--- a/core/modules/language/src/Tests/LanguageConfigurationElementTest.php
+++ b/core/modules/language/src/Tests/LanguageConfigurationElementTest.php
@@ -28,7 +28,7 @@ class LanguageConfigurationElementTest extends WebTestBase {
 
   protected function setUp() {
     parent::setUp();
-    $user = $this->drupalCreateUser(array('access administration pages', 'administer languages', 'administer content types'));
+    $user = $this->drupalCreateUser(array('access administration pages', 'administer languages', 'administer content types', 'administer node fields'));
     $this->drupalLogin($user);
   }
 
diff --git a/core/modules/node/src/Tests/NodeTypeTest.php b/core/modules/node/src/Tests/NodeTypeTest.php
index 97f6738..1e8be63 100644
--- a/core/modules/node/src/Tests/NodeTypeTest.php
+++ b/core/modules/node/src/Tests/NodeTypeTest.php
@@ -62,7 +62,7 @@ function testNodeTypeCreation() {
     $this->assertResponse(200, 'The new content type can be accessed at node/add.');
 
     // Create a content type via the user interface.
-    $web_user = $this->drupalCreateUser(array('bypass node access', 'administer content types'));
+    $web_user = $this->drupalCreateUser(array('bypass node access', 'administer content types', 'administer node fields'));
     $this->drupalLogin($web_user);
     $edit = array(
       'name' => 'foo',
diff --git a/core/modules/node/src/Tests/Views/BulkFormAccessTest.php b/core/modules/node/src/Tests/Views/BulkFormAccessTest.php
index 480f931..ec473d4 100644
--- a/core/modules/node/src/Tests/Views/BulkFormAccessTest.php
+++ b/core/modules/node/src/Tests/Views/BulkFormAccessTest.php
@@ -141,7 +141,7 @@ public function testNodeDeleteAccess() {
       'uid' => $author->id(),
     ));
     // Create an account that may view the private node, but not delete it.
-    $account = $this->drupalCreateUser(array('access content', 'administer nodes', 'delete own article content', 'node test view'));
+    $account = $this->drupalCreateUser(array('access content', 'access content overview', 'administer nodes', 'delete own article content', 'node test view'));
     // Create a node that may be deleted too, to ensure the delete confirmation
     // page is shown later. In node_access_test.module, nodes may only be
     // deleted by the author.
diff --git a/core/modules/system/system.routing.yml b/core/modules/system/system.routing.yml
index 2da5126..4f69b04 100644
--- a/core/modules/system/system.routing.yml
+++ b/core/modules/system/system.routing.yml
@@ -391,6 +391,8 @@ system.theme_settings_theme:
 
 '<current>':
   path: '<current>'
+  requirements:
+    _access: 'TRUE'
 
 system.modules_uninstall:
   path: '/admin/modules/uninstall'
diff --git a/core/modules/system/tests/modules/entity_test/src/EntityTestForm.php b/core/modules/system/tests/modules/entity_test/src/EntityTestForm.php
index 59e798b..480453e 100644
--- a/core/modules/system/tests/modules/entity_test/src/EntityTestForm.php
+++ b/core/modules/system/tests/modules/entity_test/src/EntityTestForm.php
@@ -70,18 +70,18 @@ public function save(array $form, FormStateInterface $form_state) {
       }
       drupal_set_message($message);
 
-      if ($entity->id()) {
+      if (!$entity->id()) {
+        // Error on save.
+        drupal_set_message(t('The entity could not be saved.'), 'error');
+        $form_state->setRebuild();
+      }
+      elseif ($entity->access('update')) {
         $entity_type = $entity->getEntityTypeId();
         $form_state->setRedirect(
           "entity.$entity_type.edit_form",
           array($entity_type => $entity->id())
         );
       }
-      else {
-        // Error on save.
-        drupal_set_message(t('The entity could not be saved.'), 'error');
-        $form_state->setRebuild();
-      }
     }
     catch (\Exception $e) {
       \Drupal::state()->set('entity_test.form.save.exception', get_class($e) . ': ' . $e->getMessage());
diff --git a/core/modules/user/src/Form/UserLoginForm.php b/core/modules/user/src/Form/UserLoginForm.php
index 1c7a342..bb59e28 100644
--- a/core/modules/user/src/Form/UserLoginForm.php
+++ b/core/modules/user/src/Form/UserLoginForm.php
@@ -135,6 +135,8 @@ public function buildForm(array $form, FormStateInterface $form_state) {
   public function submitForm(array &$form, FormStateInterface $form_state) {
     $account = $this->userStorage->load($form_state->get('uid'));
 
+    user_login_finalize($account);
+
     // A destination was set, probably on an exception controller,
     if (!$this->getRequest()->request->has('destination')) {
       $form_state->setRedirect(
@@ -145,8 +147,6 @@ public function submitForm(array &$form, FormStateInterface $form_state) {
     else {
       $this->getRequest()->query->set('destination', $this->getRequest()->request->get('destination'));
     }
-
-    user_login_finalize($account);
   }
 
   /**
diff --git a/core/modules/user/src/Form/UserPasswordForm.php b/core/modules/user/src/Form/UserPasswordForm.php
index 8a1a839..92ff0cf 100644
--- a/core/modules/user/src/Form/UserPasswordForm.php
+++ b/core/modules/user/src/Form/UserPasswordForm.php
@@ -150,7 +150,7 @@ public function submitForm(array &$form, FormStateInterface $form_state) {
       drupal_set_message($this->t('Further instructions have been sent to your email address.'));
     }
 
-    $form_state->setRedirect('user.page');
+    $form_state->setRedirect('user.login');
   }
 
 }
diff --git a/core/modules/user/src/Tests/UserCancelTest.php b/core/modules/user/src/Tests/UserCancelTest.php
index 5357013..55370835 100644
--- a/core/modules/user/src/Tests/UserCancelTest.php
+++ b/core/modules/user/src/Tests/UserCancelTest.php
@@ -82,7 +82,7 @@ public function testUserCancelChangePermission() {
     // Create a regular user.
     $account = $this->drupalCreateUser(array());
 
-    $admin_user = $this->drupalCreateUser(array('cancel other accounts'));
+    $admin_user = $this->drupalCreateUser(array('administer users', 'cancel other accounts'));
     $this->drupalLogin($admin_user);
 
     // Delete regular user.