So an origin doesn't include a path. Well.

server.js

 app.use(bodyParser.json());
 // Allow cross-origin requests.
 var corsOptions = {
-  origin: settings.formUrl,
+  origin: settings.formOrigin,
   optionsSuccessStatus: 200 // some legacy browsers (IE11, various SmartTVs) choke on 204
 };
 app.use(cors(corsOptions));
-
+// Taking care of preflight requests
 app.options('*', cors(corsOptions));
 
 

settings.example.json

         "you@example.tld",
         "someone.else@example.com"
     ],
-    "formUrl": "https://example.tld/contact"
+    "formOrigin": "https://example.tld"
 }