When a contract sends an inline action, it cannot send with the permission level passed by the caller; it sends with a special `eosio.code` permission name. 

In your example, `makepokemon` can only use `[email protected]` and not `user@active`, so `user` has to explictily give `makepokemon` permission to transfer tokens if they want to.