To save user preferences, the user must be authenticated. As the current theme is a user setting, it's loaded when the user object is created in the system. Submitted data is only processed after user permissions are checked.

The only solution I see is to defer loading user preferences until absolutely necessary. As this involves another database hit, it doesn't seem worth slowing things down for such an uncommon operation. (If there's a better solution, I'm all ears.)