Implement Drug Controller

Added AuthorizeForRole attribute but may not need.