diff --git a/core/modules/simpletest/src/WebTestBase.php b/core/modules/simpletest/src/WebTestBase.php
index ab560b2..2258a03 100644
--- a/core/modules/simpletest/src/WebTestBase.php
+++ b/core/modules/simpletest/src/WebTestBase.php
@@ -709,7 +709,7 @@ protected function drupalLogout() {
     // Make a request to the logout page, and redirect to the user page, the
     // idea being if you were properly logged out you should be seeing a login
     // screen.
-    $this->drupalGet('user/logout', array('query' => array('destination' => 'user')));
+    $this->drupalGet(\Drupal::url('user.logout'), array('query' => array('destination' => 'user')));
     $this->assertResponse(200, 'User was logged out.');
     $pass = $this->assertField('name', 'Username field found.', 'Logout');
     $pass = $pass && $this->assertField('pass', 'Password field found.', 'Logout');
diff --git a/core/modules/user/user.module b/core/modules/user/user.module
index e33cd28..b733068 100644
--- a/core/modules/user/user.module
+++ b/core/modules/user/user.module
@@ -1440,7 +1440,7 @@ function user_toolbar() {
     $links = array(
       'account' => array(
         'title' => t('View profile'),
-        'href' => 'user',
+        'route_name' => 'user.page',
         'html' => TRUE,
         'attributes' => array(
           'title' => t('User account'),
@@ -1448,7 +1448,8 @@ function user_toolbar() {
       ),
       'account_edit' => array(
         'title' => t('Edit profile'),
-        'href' => 'user/' . $user->id() . '/edit',
+        'route_name' => 'user.edit',
+        'route_parameters' => array('user' => $user->id()),
         'html' => TRUE,
         'attributes' => array(
           'title' => t('Edit user account'),
@@ -1456,7 +1457,7 @@ function user_toolbar() {
       ),
       'logout' => array(
         'title' => t('Log out'),
-        'href' => 'user/logout',
+        'route_name' => 'user.logout',
       ),
     );
   }
@@ -1464,7 +1465,7 @@ function user_toolbar() {
      $links = array(
       'login' => array(
         'title' => t('Log in'),
-        'href' => 'user',
+        'route_name' => 'user.login',
       ),
     );
   }
diff --git a/core/modules/user/user.routing.yml b/core/modules/user/user.routing.yml
index a036d4b..ae73ec7 100644
--- a/core/modules/user/user.routing.yml
+++ b/core/modules/user/user.routing.yml
@@ -12,6 +12,7 @@ user.logout:
     _controller: '\Drupal\user\Controller\UserController::logout'
   requirements:
     _user_is_logged_in: 'TRUE'
+    _csrf_token: 'TRUE'
 
 user.autocomplete:
   path: '/user/autocomplete'