When a contract sends an inline action, it cannot send with the permission level passed by the caller, it sends with a special eosio.code permission name.
In your example, makepokemon can ony use [email protected] and not user@active, so user has to explictily give makepokemon permission to transfer tokens if they want to.