Question

..or should I just go ahead and store them right in the users table even though they will mostly be null?

Answer 1

For normalization reasons I would put them in a separate table.

table user
-------------
id integer primary key auto_increment
username varchar
salt_passhash varchar
......

table tokenreset
---------------
id integer primary key auto_increment
user_id integer
when_requested timestamp
all_done boolean default false

If you want to know the users that need to have their passwords reset do:

SELECT u.id, u.username, u.email FROM user u
INNER JOIN tokenreset tr ON (u.id = tk.user_id)
WHERE NOT(tr.alldone)

Or code of that nature.

This way you will not have a field in user that does not get used 95% of the time.