diff --git a/bookwyrm/models/site.py b/bookwyrm/models/site.py
index 6c2381f8a..0f56162b1 100644
--- a/bookwyrm/models/site.py
+++ b/bookwyrm/models/site.py
@@ -16,7 +16,23 @@ from .user import User
 from .fields import get_absolute_url
 
 
-class SiteSettings(models.Model):
+class SiteModel(models.Model):
+    """we just need edit perms"""
+
+    class Meta:
+        """this is just here to provide default fields for other models"""
+
+        abstract = True
+
+    # pylint: disable=no-self-use
+    def raise_not_editable(self, viewer):
+        """Check if the user has the right permissions"""
+        if viewer.has_perm("bookwyrm.edit_instance_settings"):
+            return
+        raise PermissionDenied()
+
+
+class SiteSettings(SiteModel):
     """customized settings for this instance"""
 
     name = models.CharField(default="BookWyrm", max_length=100)
@@ -115,15 +131,8 @@ class SiteSettings(models.Model):
             self.invite_question_text = "What is your favourite book?"
         super().save(*args, **kwargs)
 
-    # pylint: disable=no-self-use
-    def raise_not_editable(self, viewer):
-        """Check if the user has the right permissions"""
-        if viewer.has_perm("bookwyrm.edit_instance_settings"):
-            return
-        raise PermissionDenied()
 
-
-class Theme(models.Model):
+class Theme(SiteModel):
     """Theme files"""
 
     created_date = models.DateTimeField(auto_now_add=True)
diff --git a/bookwyrm/templates/settings/themes.html b/bookwyrm/templates/settings/themes.html
index afa3f0be4..628b04d77 100644
--- a/bookwyrm/templates/settings/themes.html
+++ b/bookwyrm/templates/settings/themes.html
@@ -54,7 +54,6 @@
         method="POST"
         action="{% url 'settings-themes' %}"
         class="box"
-        enctype="multipart/form-data"
     >
     <fieldset>
         {% csrf_token %}
diff --git a/bookwyrm/tests/views/admin/test_themes.py b/bookwyrm/tests/views/admin/test_themes.py
new file mode 100644
index 000000000..bc6377681
--- /dev/null
+++ b/bookwyrm/tests/views/admin/test_themes.py
@@ -0,0 +1,88 @@
+""" test for app action functionality """
+from unittest.mock import patch
+
+from django.contrib.auth.models import Group
+from django.core.exceptions import PermissionDenied
+from django.template.response import TemplateResponse
+from django.test import TestCase
+from django.test.client import RequestFactory
+
+from bookwyrm import forms, models, views
+from bookwyrm.management.commands import initdb
+from bookwyrm.tests.validate_html import validate_html
+
+
+class AdminThemesViews(TestCase):
+    """Edit site settings"""
+
+    # pylint: disable=invalid-name
+    def setUp(self):
+        """we need basic test data and mocks"""
+        self.factory = RequestFactory()
+        with patch("bookwyrm.suggested_users.rerank_suggestions_task.delay"), patch(
+            "bookwyrm.activitystreams.populate_stream_task.delay"
+        ), patch("bookwyrm.lists_stream.populate_lists_task.delay"):
+            self.local_user = models.User.objects.create_user(
+                "mouse@local.com",
+                "mouse@mouse.mouse",
+                "password",
+                local=True,
+                localname="mouse",
+            )
+            self.another_user = models.User.objects.create_user(
+                "rat@local.com",
+                "rat@rat.rat",
+                "password",
+                local=True,
+                localname="rat",
+            )
+        initdb.init_groups()
+        initdb.init_permissions()
+        group = Group.objects.get(name="admin")
+        self.local_user.groups.set([group])
+
+        self.site = models.SiteSettings.objects.create()
+
+    def test_themes_get(self):
+        """there are so many views, this just makes sure it LOADS"""
+        view = views.Themes.as_view()
+        request = self.factory.get("")
+        request.user = self.local_user
+
+        result = view(request)
+        self.assertIsInstance(result, TemplateResponse)
+        validate_html(result.render())
+        self.assertEqual(result.status_code, 200)
+
+    def test_themes_post(self):
+        """there are so many views, this just makes sure it LOADS"""
+        view = views.Themes.as_view()
+
+        form = forms.ThemeForm()
+        form.data["name"] = "test theme"
+        form.data["path"] = "not/a/path.scss"
+        request = self.factory.post("", form.data)
+        request.user = self.local_user
+
+        result = view(request)
+
+        self.assertIsInstance(result, TemplateResponse)
+        validate_html(result.render())
+        self.assertEqual(result.status_code, 200)
+
+        theme = models.Theme.objects.last()
+        self.assertEqual(theme.name, "test theme")
+        self.assertEqual(theme.path, "not/a/path.scss")
+
+    def test_themes_post_forbidden(self):
+        """there are so many views, this just makes sure it LOADS"""
+        view = views.Themes.as_view()
+
+        form = forms.ThemeForm()
+        form.data["name"] = "test theme"
+        form.data["path"] = "not/a/path.scss"
+        request = self.factory.post("", form.data)
+        request.user = self.another_user
+
+        with self.assertRaises(PermissionDenied):
+            view(request)
diff --git a/bookwyrm/views/admin/themes.py b/bookwyrm/views/admin/themes.py
index ae9a748d3..4d795fbe0 100644
--- a/bookwyrm/views/admin/themes.py
+++ b/bookwyrm/views/admin/themes.py
@@ -24,9 +24,9 @@ class Themes(View):
 
     def post(self, request):
         """edit the site settings"""
-        form = forms.ThemeForm(request.POST, request.FILES)
+        form = forms.ThemeForm(request.POST)
         if form.is_valid():
-            form.save()
+            form.save(request)
 
         data = get_view_data()