The form is within the same file as the first form (action="#")
Your form.js is switching because of a switching param e.g. action="#?step=1"
Also within the form.js would be a web-socket what is communication with the Tessel by listening to a socket-event.
// assuming the index.html is loading the web-socket
var socket = new WebSocket('... tessels IP...');
// put the data into form
CORS shouldn't be a problem if you are able to set the header within the targeted socket. At the moment I am unsure whether the web-socket has to be delivered by the Tessel but I am nearly sure you also would be able to connect by a foreign app to the Tessel-Socket OR let the Tessel-Socket connect to the form.js web-socket. Both should be possible. Try it!. In the case of the Tessel is requested to connect by the form.js, the Tessels header should send the CORS-header.
'Access-Control-Allow-Methods: POST, GET, OPTIONS',
EDIT: I would try to create a non-tessel app for getting done the connection work. If you got it, you can use the code within your final tessel-code. (means: your run your code by node tessel-app.js without tessel relatet parts like rfid or wifi). This is because you get not enough information for debugging on tessel especially if your are unsure how to get it work.