All the examples of port security I've found show that an IP phone needs two mac-address entries, one for the voice vlan and one for the access vlan. When turning on "sticky" mode, I only ever see an entry created for the voice vlan, never for the access vlan, even when power-cycling the phone.