Is it possible to authenticate upsells as well?

Yes, but due to PCI regulations you need to tokenize the CC# and pass it over to the new page.