So first, let's write a new scenario that'll test two things:

• When querying for the salt of a non-existent user (identified by email), it will return a string with the right character count and character range
• When querying for the salt of the same non-existent user over multiple requests, the salt returned should be the same

Your feature file might look something like this:

Scenario: Retrieve Salt of Non-Existent User

 When the client creates a GET request to /salt
 And set "email=non@existent.email" as a query parameter
 And sends the request
 Then our API should respond with a 200 HTTP status code
 And the payload of the response should be a string
 And the response string should satisfy the regular expression /^\$2a\$10\$[a-zA-Z0-9\.\/]{22}$/

Scenario: Retrieve the same Salt of Non-Existent User over multiple requests

 Given the client creates a GET request to /salt
 And set "email=non@existent.email" as a query parameter
 And sends the request
 And the payload of the response should be a string
 And saves the response text in the context under salt

 When the client creates a GET request to /salt
 And set "email=non@existent.email" as a query parameter
 And sends the request
 And the payload of the response should be a string
 And the payload should be equal to context.salt

You'd also need to define the following step definition:

Then(/^the response string should satisfy the regular expression (.+)$/, function (regex) {
 const re = new RegExp(regex.trim().replace(/^\/|\/$/g, ''));
 assert.equal(re.test(this.responsePayload), true);
});

Run the tests and see them fail. Once you've done that, we are ready to implement the feature.