4.7.28 upgrade gives false warning that my resource URL is not correct
after chasing my tail for a while, I finally realized that the check for resource url is not done by the browser in a way that would pass along other validation credentials. 

This led to the resource url check, which tries to load the small arrow image used in the civiCRM admin menus, to fail in my case because all non live/production sites are behind htaccess passwords. 

When the update was moved to a publicly accessible url, the resource url check worked as expected.