diff --git a/database/routes/sessionRoutes.js b/database/routes/sessionRoutes.js
index 354dcec..07dd70f 100644
--- a/database/routes/sessionRoutes.js
+++ b/database/routes/sessionRoutes.js
@@ -12,8 +12,8 @@ router.post('/validate', async (req, res) => {
       return res.status(400).json({ error: 'sessionId required' });
     }
     
-    // Extract player name from session ID (simple format: session_playername_timestamp)
-    const match = sessionId.match(/^session_([^_]+)_\d+$/);
+    // Extract player name from session ID (format: session_playername_timestamp_random)
+    const match = sessionId.match(/^session_([^_]+)_\d+_[a-z0-9]+$/);
     if (!match) {
       logToFile('SESSION: Invalid session format', sessionId);
       return res.status(401).json({ error: 'Invalid session format' });
diff --git a/src/App.js b/src/App.js
index 6ec33a9..7e9784b 100755
--- a/src/App.js
+++ b/src/App.js
@@ -243,17 +243,17 @@ function App() {
                   <select 
                     className="rounded-lg border border-slate-600 bg-slate-800 px-3 py-2 text-white text-sm"
                     value={loginName}
-                    onChange={e=>setLoginName(e.target.value)}
+                    onChange={e=>{setLoginName(e.target.value); setLoginPw(e.target.value==='gm'?'bongo':'1234');}}
                   >
                     <option value="">Select user...</option>
-                    {players.filter(p => p.name !== 'gm').map(p => (
+                    {players.map(p => (
                       <option key={p.name} value={p.name}>{p.name}</option>
                     ))}
                   </select>
                   <input 
                     className="rounded-lg border border-slate-600 bg-slate-800 px-3 py-2 text-white placeholder-slate-400 text-sm" 
                     type="password" 
-                    placeholder="Password (all users: 1234)" 
+                    placeholder="Password (auto-filled)" 
                     value={loginPw} 
                     onChange={e=>setLoginPw(e.target.value)} 
                     onKeyPress={handleKeyPress}
@@ -373,7 +373,7 @@ function App() {
               {players && players.length > 0 ? players.map(player => (
                 <button
                   key={player.name}
-                  onClick={() => {setLoginName(player.name); setLoginPw(process.env.REACT_APP_PLAYER_PASSWORD || 'defaultpassword');}}
+                  onClick={() => {setLoginName(player.name); setLoginPw(player.name==='gm'?'bongo':'1234');}}
                   className="px-2 py-1 rounded bg-blue-700/30 text-blue-200 hover:bg-blue-600/40 transition-colors"
                 >
                   {player.name}
@@ -382,7 +382,7 @@ function App() {
                 <div className="text-xs text-blue-200/60">No users found. Click Refresh or check backend.</div>
               )}
             </div>
-            <p className="text-xs text-blue-300/70 mt-2">Password for all users: <code className="bg-blue-800/40 px-1 rounded">1234</code></p>
+            <p className="text-xs text-blue-300/70 mt-2">Players: <code className="bg-blue-800/40 px-1 rounded">1234</code> | GM: <code className="bg-blue-800/40 px-1 rounded">bongo</code></p>
           </div>
         )}